(or at least disable it in a way that it can't be re-enabled without ADB or some action from the owner profile?)
Yes, I know my profile setup is weird. I want a profile without a browser, ok? Is there any magic ADB incantation that can do this for me?