Before First Unlock (BFU) means user data is encrypted and unavailable.
After first unlock (AFU) means encryption keys are in memory and user data is available to the operating system.
Secondary users can be put back into BFU state with the device running by using 'end session' option from the power button menu or the lockscreen. To get owner user to BFU requires a device restart.