How should that work?
My GrapheneOS Android doesn't look any different than any other Android - and they'd need to look at my screen while walking by or something.

They can't even see the exact Android version without trying to access it - or having me show them explicitly my "About phone" screen or something

I really don't see how that should work in practice

If they pick me out and want to scan my phone, then it could be used against me, that they can't access my data.
But hey, that's what GrapheneOS is here for, to don't allow anyone access to my data, who shouldn't have access

So, in practice this is not really relevant or do I misunderstand something?