It seems like that might be useful. As I understand, the post says that one would only have to type the long password once every 48 hours, and in between one can use PIN+fingerprint. Actually, if I understand correctly, it seems to say the preceding sentence currently applies if "PIN+fingerprint" is replaced with "fingerprint" only ("The usual restrictions on fingerprint unlock still apply. It's a secondary unlock mechanism only usable for 48 hours after the last primary unlock"), i.e., the only thing that is new is the 2-factor with PIN (if I understand correctly). In that case, I would not have to wait for the new version of GrapheneOS to be released. (Presumably one would also have to type the password after reboot, even if less than 48 hours?)
But I wonder if anyone can answer the question I posed in the last paragraph of my original post: Suppose that a person has offline brute-force access to the internal storage (so there is no throttling of attempts). My question is: Does a strong password for the special Owner user provide any level of protection for secondary user profiles on the phone? Is the encryption nested, or if not nested, does the key derivation for the secondary user profiles depend on knowing the password of the special Owner user?
In other words, if I set the protection for the secondary user to None, or if I publish my fingerprint and PIN on the Internet, is a person who is able to bypass the OS able to read the data in the secondary user account, or do they need to also know the Owner's password in order to decrypt the secondary user account?
I note that after reboot I am not allowed to switch to a secondary user unless I type the Owner password first. But is this merely enforced by the OS, or is it enforced cryptographically? I.e., can a person that has bypassed the OS and the "secure element" and has the hardware keys and all that, access a secondary user profile's data without needing to provide (or guess) the Owner password like I have to?