The key thing here is DNS and also saying that VM 'block' websites is a little misleading.
Imagine that near your home is a local park say, known for attracting unsavoury characters, and you would rather that your son doesn't visit it - so what you do is don't tell him how to get there. DNS is a sort of address book, it tells your devices how to get to particular sites (OK it's actually more complex than that but it's not a too bad an analogy), you might think of it as a local A-Z set of road maps.
The way VM's web safe works is to sort of have a special A-Z road map where the local park isn't listed so you don't know how to get there, but there is absolutely nothing to prevent your son using another A-Z, looking up where the park is and setting off.
So if you subscribe to VM's web safe, by default the DNS it provides to your devices is the 'special' version, but if you or your son, change the DNS setting on an individual device to a different DNS server, then all of the 'blocking' is immediately undone - you 'see' where the park is now and off you go!
Really isn't much you can do about it, like I said the VM system doesn't block anything rather just hides it.
Unless there is a way of preventing changes to the network settings on the headset and the X-box - and I know little about either of them, but I don't believe there is; then your only other alternative would be to invest in a more sophisticated network firewall with much better parental control facilities. Alas these things tend to be a) not cheap and b) require a lot more work to be done in the configuration.
