Let's imagine a scenario where you know some untrusted party has the password to your owner profile. The details of how that happened are irrelevant. Your owner profile has no personal information in it. All personal information is in secondary profiles. The untrusted party doesn't have the password to any other profile than the owner.
Once you receive your phone back, what steps should you go through to verify that nothing malicious has been done to the phone, such as some type of ADB modifications, or installed software? Let's forget about factory reset for the sake of discussion.
The threat model is also not relevant for this question. It would be helpful to discuss a range of threat models, so we can decide which actions fit our own. Discussing for only one specific threat model isn't so useful for a broader population.