alf1342 In this context, does configuring the other user sessions to "disable app install and updates" reduce the risk that this user may be compromised ?
Probably not. Even if secondary user B can install apps, those apps will only be made available in user B. They won't be made available in owner user A or any secondary user C, so won't ever start or run there. So if hypothetically an app in user B can be fooled into installing a malicious app, that app will also run in user B, and thus the attacker would still be left trying to perform their attacks from within the context of user B.
alf1342 Does it reduce the risk that a compromised user session could install something in the others users? If so, to what extent?
I wonder if this question really makes sense. There is an app sandbox, but that is about it. If the question is if a compromised app can install an app in another user profile, no, they cannot do that regardless of if you allow app installs or not. If the question is instead whether an attacker that have been able to break out of the app sandbox for an app running in secondary user B, I actually don't think is really matters what user that app was running as anymore, as there is no meaningful isolation between user profiles other than the app sandbox and what apps within a certain user profile can be granted access to while within the confines of the app sandbox.
alf1342 I understand that if malware manages to execute kernel-level code, it can pretty much install whatever it wants in the other sessions.
If they can execute kernel-level code, they can do anything. They don't need to install an app anywhere, they can just read out any data from any user profile they want. Or modify or destroy any data from any user profile.
I don't know how common kernel-level exploits are in state-sponsored malware. But it would be the holy grail if they can get that access, and they might have the capability to, which is why GrapheneOS is trying to harden the kernel further, and want to implement virtualization in the future to lower the attack surface.
alf1342 Doesn't this advice give a false sense of security in terms of isolation from such a threat?
Yeah, I would say so. If you don't need to install apps from within secondary user profiles, you can just disable the possibility. It may possible make exploitation within that user profile slightly harder, in case an app can be fooled into installing another app, but the hacker cannot gain persistence within the original app. But I think that is the extent to which this feature provides security.