My issue isn't about the notification, but that this doesn't work at all within any reasonable model of user permissions.
Fundamentally, authority cannot be delegated authority that you yourself don't have. I can agree to a contract promising to do some particular work, because I have the authority to direct my actions. I cannot agree to a contract promising that you will do some particular work, because you haven't granted me that authority. I cannot grant to another what I do not have for myself.
With regards to user permissions, a non-administrator doesn't have permission to monitor another user's activity. Therefore, they cannot delegate permission to a third party to monitor another user's activity. That this is possible means that ChromeOS has a fundamentally flawed model of user permissions.
Windows does this as well, and I would expect other management solutions to as well. You can build your own PC and be local admin on it, but the second you sign in to an active directory account (using a VPN for work) that account will be locked down and can run scripts that the AD owner chooses. I imagine that is what is happening here as well, where the user has signed into the school Google Workspace account (or whatever it's called these days). To avoid this, they could sign in to Google Docs and Google Classroom in a browser. (Although to be fair, Chrome does aggressively ask if you want to sign into Chrome with your account, and probably if you want to sign into the user profile on ChromeOS if I had to guess)
Having said all that the default will be for most school accounts… all or nothing. Don’t allow them to manage it and you won’t get in.