Hello, friend!
Generally, the ONT has only two users (administrator account and default user account).
The administrator account is used for ISP or engineer maintenance.
The default user account is the account and password on the ONT nameplate.
Generally, the administrator account has higher permissions than the default user account.
If you have three or more users who can log in to the device, the device may be a customized product. The customized product is different from the general-purpose product, depending on the customization requirements.
According to your question description, the default user has modified the parental control template created by the administrator account. Because parental control is an application-layer setting, all permissions can be created and changed.
Thanks!