First may I say what a legend your son is. For context, I'm a funded PhD student in the UK and I'm currently VP Lead Cloud Engineer for the central banking and regulatory arm of Barclays Bank (a division known as RFT). I also advise the UK government on national security strategy and countermeasures to cyberwarfare affecting critical infrastructure. At the heart of it, I'm just a guy who loves my craft. I jumped from a junior engineer to a VP in less than a year (something I occasionally have regrets about). When I finished my MSc I was admitted to the faculty at my university because they wanted to perpetuate our relationship, I began teaching on the apprenticeship, MComp and MSc Cybersecurity courses.
Your question reminds me a lot of Akrit Jaswal, otherwise known as the 7 year old surgeon. He applied for a PhD at Imperial College London as a young child. He was refused admission, but that doesn't detract from the fact that he was performing surgeries at that age. The reason he was refused admission is because he was deemed to have insufficient life experience to make a real contribution. They also thought that he needed to be allowed to have a childhood.
Granted your son is a bit older, this does remind me a lot of Akrit Jaswal. Whilst at the core of it, theoretical computer science is heavily mathematics and totally impersonal, many of the problems that research contributions need to address have a temporal dimension to them. Many of the innovations we see are not as a result of a genius finding the solution to a difficult mathematical problem, but lie in the humanity of what we do.
Before I entered software development and cloud engineering as a full time commitment, I had programmed since I was 8 years old and started to sell my skills at 14. Ironically, when I left school I trained to be a nurse and then became a lawyer (I'm far from a perfect man) - totally different professions. Unfortunately I didn't take the path of CS until much later in my life. The experience life has given me though allows me to be a good researcher. That isn't to say that to be a good researcher you need have lots of life experiences, but it helps significantly. My research area is trustless security, an area which is a hot topic right now given the increasing use of computers as weapons. The problem I'm working with goes much more beyond mathematics and founds itself in human nature, something that is very complicated indeed.
What I would say is that you should consider what you want the endpoint for your son to be. Does he want to be a researcher and only that? Or does he want to take his time to enjoy his youth and figure things out as he goes?
In the UK your son would be turned down for a PhD not because he isn't absolutely fantastic (which from what you say he clearly is), but because his contributions would be limited by his age. Many PhD students worldwide are considered successful if they publish just a single research paper, many PhDs can be submitted with just two good journal publications in solid journals. One of the final tests however is a viva which taps much deeper into the context of your research. A good admissions tutor would be able to detect the likelihood such a young man would be prejudiced through a lack of life experience and wider context. Another measure of a successful researcher is a wider understanding of the implications of their research and an ability to network and promote their research - I think this is where your son would fall down at his age. I don't say this in a negative way, but purely to give you a realistic view of what is required.
I began publishing as soon as I started my MSc, but this is not a measure of success. The reason I have been the leading author in the publications I have been involved in to-date is because I have networked with a large group and collaborated in a way that would not have been possible had that collaboration not existed.
I hope this provides a better view of where your son would sit in relation to a PhD. Ask yourself this, what are you trying to achieve? Is your son trying to obtain a qualification or make a wider contribution? If the latter, is he in a position to do that right now?
This is the fundamental difference between a PhD and any other type of qualification. It's not a benchmark, its an award for contributing to the state of the art, going much more beyond core academia but to the connection between the output of the PhD and the benefit of that output to the rest of the world and the impact it is able to have.