Noticed that if I install an app on main profile and then use "Install available apps" feature to install this app on another profile, on this other profile the app has network permission on by default.
I overcame this problem by using Rethink DNS, restricting internet access for all yet unknown apps, but would be nice to have GrapheneOS disable network access by default and present an "Allow Network access?" dialog once the app launched for the first time (probably not as easy to implement) or when the profile is activated after having some apps pushed to this profile from the main profile.
