Owner user has to be unlocked before the device can be used and is then always running until reboot.
Secondary users can be stopped, and encryption keys flushed, at any time while using them by using the 'end session' option in the power button menu or their lockscreen.
Theres some functionality that can only be switched on and off from inside the owner user profile (eg. wifi hotspot)
Unlike in secondary user profiles, somebody using the owner user can see a list of all apps installed on the device from Settings and can uninstall apps from all user profiles.