This is the way it works. A "domain" and "www.domain" are two different entities on the internet. Some related threads at the bottom. The solution is to expand the block lists (or the resulting gravity list) to put "www" at the beginning, and also have the plain domain on the list as well. I think some users may have done some work with scripts that do this - @anon55913113?
Some of the porn-blocking lists already have this in place - https://tspprs.com is one. I have read that their list is fairly effective.
If your goal is to create a kid-friendly network, you might also consider using OpenDNS or another one of the filtered upstream DNS providers. They do some blocking at the source.
If there are any remaining that sneak through, a blacklist entry would knock them out. An additional option that would work for any sites that sneak through after this would be regex filters.