I just got my phone switched to an esim and am wondering if there is any hardening I need to configure.

The esim pin has been set, sim lock and port out lock set with the provider.

I am also interest in theft deterrence. If someone steals the phone I know they can't use the esim without the PIN - would doing a factory reset still require the PIN in order to delete it or could it just be deleted once the phone is set up? I go to a lot of festivals where phone theft is rampant - if I ever do lose my phone i'd like for them to have a brick they can't even get around imei blocking by shipping it out of country.

Without talking about the Duress function.

Wiping the device or installing another OS will not erase the eSIM.
The eSIM will remain locked with the code.

I have several eSims installed and have factory reset my phone on every GrapheneOS release. (I know...It's just what I do)
The eSims are never deleted unless you specifically turn on the delete eSim toggle switch.
I have read that setting an eSim pin can cause problems.
I am sure it was on this discussion forum.
I don't use an eSim pin, because you have to get past the user pin first, which makes it superfluous.
With a physical sim that can be removed a sim pin I would think is essential

    geko If someone does a factory reset from recovery, doesn't that just open the esim up to use without a pin?

    I know that reset does not delete the pin unless it is selected to do so and that resetting it from recovery does not delete it. But if a phone is reset from recovery, does that give whoever has the phone the ability to remove it when the phone is set up again?

      You may be right, I have never had occasion to use or experiment with recovery.

      NetRunner88 omg that makes obscenely plain sense I don't know why I didn't realize that.

      Tangential to that however - since the P8P has two sim slots, would I need to get some sort of second esim in the other slot to keep it from working after putting in a physical sim? Or would all sims have to be unlocked first?

      I may just get some kind of crappy prepaid esim to stick in it then let it lapse. I assume there are still 5 dollar sms only prepaid plans around

      I have plenty of eSIM and only the one I use ask for the pin not the others.
      When I switch eSIM obviously the other one I choose ask for the code.

      For my use case, those with prepaid plans aren't with pin because it is useless for me, in case of theft the prepaid plan can be used, I will not be charged more.