Is there a reason why GrapheneOS is doing apps optimization after I enter my PIN and not right after update completed?

It does that after the new Android 14 update. I don't like it either but they did it this way because if not when upgrading it will take like an hour or two hours per upgrade, many people were complaining so that's why they did the switch like this.

You can just unlock it once after reboot and keep it locked while waiting for it to be done in the meantime.

    In Android 13, otapreopt was used to do precompilation of apps in the background in the Finalizing update step before reboot. However this is broken in Android 14, and is therefore, at least temporarily, not possible on GrapheneOS.

    otapreopt being broken in Android 14 led to very long boot times after each update, of more than 30 minutes, as GrapheneLover has said, which is considered impractical.

    Therefore, since release 2023102300 speed-profile compilation for user installed packages has been used to significantly improve boot time during first boot of an update. Apps are now recompiled with full speed optimization in the background with a progress notification and a notification when it's finished for respawning apps.

    Hope that helps to clarify things. I have based this response on the release notes on the GrapheneOS website:
    https://grapheneos.org/releases#2023102300