I’m pretty sure the only way they could’ve killed everything on your smart things account would be through smartthings account functions, like deleting the location. It wouldn’t be enough to just get a virus on the network or something like that.
So that’s just something to be aware of as you look for future preventive measures. In particular, you want to look at whether they have access to your smartthings account itself.
Are you using the presence sensor feature Of the smartthings mobile app on the kids’ phones? If so, you might want to switch to life 360 or IFTTT presence for them so they don’t have to have the smartthings mobile app for presence.