Lucario1829 and that is wrong because owner profile is better used as installer profile, at least because there is no IPC scopes yet, so any app signed by google play store with network connection is at risk of IPC communication. the idea is to use google camera, photo, whatever google app and any other app downloaded from play market without network connection in the profile with no google play services or with them but without network permission and only give network permission to open source apps recognised as no IPC hole and ideally that are signed by developer keys (i.e. not fdroids insecure build environment), and to use this proprietary apps with network access that can leak via IPC in secondary profile or in private space of main profile (not owner) for convenience. but there are other reasons mentioned why you don't want to give owner profile passphrase to attacker like data lanes of usb port and adb access, which are not available in secondary profile.
this setup is actually a plausible deniability/security/privacy mix for many edge cases and actually is important in violent locations.
once you understand limits of today's grapheneos (for example absence of IPC scopes and decoy profile) you'll understand this concept and will see that it is actually simple.