It's quite common among communities that have heavy phone restrictions (religious kids that go to public schools, etc.) They're as clever as adults are, just more monitored.
They are also less encumbered by thoughts of consequences.
I worked on a contract one time where they were trying to alerts for college sports, and I insisted on adding some security to the system. The manager reasoned that the cost/benefit analysis for someone deciding to hack a sport score feed did not add up and so nobody would think to try that.
I pointed out that college students have poor risk assessment. I pointed out MIT/Stanford. I pointed out it was already written. They made me rip it all out. And then the customer cancelled the project because 'we' had given them exactly the system they already had and why should he pay for it again. I just stared at the manager, who avoided eye contact. (If I'd been a bigger and braver person I would have jumped in here with a counterproposal that amounted to restoring all of my changes, but I did not think of it)
Which is just as well because there totally would be fake messages sent out during the last timeout stating that <our team> won by 6 points just for the lulz. Because of course they would.