someone1223
If I had to take a guess by what GrapheneOS meant, as someone who has not really read much documentation on how Pixel devices handle its encryption, the quote is stating "after first unlock, the encryption key for that user is stored in a segment of memory not accessible by GOS."
Which suggests a separate process thats mapped differently in memory handles encryption/decryption. That doesn't sound right but also doesn't sound wrong...will let someone else clarify that one
"If I am forced to unlock my primary profiles, does the secondary profiles will get decrypted, or even the keys fetched?", no, those are stored in the Titan M chip until authentication is confirmed by it. This requires your set password of course
"Upon using end session, all memory used by that secondary profile including the keys from Titan M is purged", as far as I understand, yes, this is the case. The owner can also be cleared with a reboot (however, unlocking the device again will reload the key)