It sounds like your diagnosis that the vehicle went into Safe or limp-home mode is spot on. Being fully loaded and travelling at speed up a long hill on a super-hot day could certainly be enough to make the car enter limp-home mode for its own preservation. This is confirmed by the fact that after a break and downhill run, the temperature stabilised and the car came back to full functionality.

Modern turbo-diesel engines make lots of power and torque these days, but they do that by burning fuel and that creates heat. You might also find that the limp-home mode initiation was at the behest of the transmission which would also be damaged if it got too hot.

Car-makers have designed these limp-home modes to protect the vehicle from permanent damage in severe operating conditions, and in your car, it seems to have done its job perfectly. The only unknown is whether the limp-home mode was initiated by the conditions or something actually wrong with the vehicle. It would be wise to have it checked over to make sure the cooling, fuel-injection and transmission systems don’t have a separate problem that is causing the Everest to enter Safe mode.

The Everest has a longer list of safety features, a higher towing capacity, is more family-friendly, and drives nicer; the Prado is more refined, but feels dated, the Discovery Sport is a true off-roader with car-like road manners. The Discovery for mine. Another to try is the Toyota Fortuner.

They all have child seat anchorages in the second row, but you're right that the Everest has anchorages in the second and third rows. The Everest would be the one to go for; it's got the most up-to-date cabin and would be best suited to your needs.