I think the Hudl has a basic "all or nothing" / "adult or child" setting.
What you get when you use leading edge hardware suppliers like Tesco
but yes, the router idea could work; even my rubbish virgin media superhub has some parental controls based on MAC values, so it could restrict a specific hardware device, ( while it is in the house anyway)
& surely it's possible to force password control on play store purchases. I have that "on" for amazon app store /video store/ book store on my kindlefire for "fat finger" protection.
alternatively, having no stored credit cards at Google is pretty good protection, just enter as needed, then delete.