aw22 Is there any fundamental reason why a tool couldn't be written to take a snapshot and restore the entire disk on a GrapheneOS device with identical Secure Element hardware?
No, but there are substantial non-fundamental reasons. The current encryption system is designed so that "half" of each encryption key is never available to the operating system. Entering a PIN or passphrase causes the secure element to send a key to the storage hardware using an encrypted pathway. So if a target system has the encrypted disk partition plus your PIN/passphrase, decryption won't work. A long time ago there wasn't a "secret half" for each key, so that wasn't an issue.
If would be possible to unlock each profile in turn and back up the files in the profile, but restoring is at least a little messy unless the target system is running exactly the same system image as the source. That can be done for the border case but not for restoring a backup from two weeks ago. And the code to do this (in either case) is complicated -- this is roughly what SeedVault does and, though it should be possible to do better than it does, "possible" isn't the same thing as "easy".