Hey everyone. Circling back to this after having a chat with the team to be able to provide a correct response.
Separate profiles should be treated separately when it comes to their lock method. If you want to protect a profile, you should use an unlock method for it that is according to your threat model.
While it is true that currently Owner has to be unlocked before attempts on secondary user profiles can be made, it isn't out of the question for AOSP to change that behavior in the future if they regard it as a limitation, which they likely do (from a UX standpoint and considering the fact that multiple users are meant to be used by individual people, having to have the owner present before you can unlock your own profile after a reboot isn't great).
I hope that helps!