Not a lawyer, but deeply involved in the law from the tech side for many years at various deeper levels from the engineering side and bridge to product and so forth.

It doesn't need to be unconstitutional to be struck down as the constitution doesn't cover all laws, especially not state and local laws. All you need to do is prove that the language or intent of the law is either:

1. impossible to enforce (ex: software processes cannot be patented or controlled/patrolled)
2. the language is too broad (ex: What is an OS exactly?)
3. it violates a prexisting law or creates a verifiable conundrum (ex: this would violate California's own data privacy laws)
4. it creates an undue tax or burden on existing technology (ex: devices out in the wild can't be retrofitted to comply, which sort of fits with #1)
5. it DOES actually violate a constitutional right (ex: 4th amendment)

Being on my side of things, the legal team would most likely start a case with something like "So you say the OS needs to be locked with age verification. Does that mean every TV, router, public computer, tablet...blah blah blah", so it's very likely to get tossed on #1 quite easily because these folks have no idea what an OS actually is, and that every piece of technology you interact with on a daily basis has an OS. The lack of specificity alone would get this tossed in a heartbeat.

If that failed, they'd argue there is no way to police or enforce this law because sites who rely on this rule existing are putting themselves in legal jeopardy by simply allowing any traffic from California to access their services. What if someone from another state or country is in California and wants to watch porn in their hotel, or play a game with friends on Discord? Police have zero right to verify that any device entering California complies with the law, so the provider of the service would have to be on the hook to do the verification, which means they would just block any device from California that doesn't meet whatever flag is sent to say it safe. THEN you have the infrastructure that is required to ensure those devices...blah blah blah.

It's just a stupid idea by dumbass technically illiterate people. It won't go anywhere.

As soon as these idiots figure out what an OS is, this is dead in the water because of the above.