You can setup different users on GrapheneOS and switch between them.

There is also a "private area" in the bottom of the app list where you can move sensitive apps and password protect them.

Either way, allowing a malicious actor into that profile exposes more attack surface for them to exploit.

Idk. Security is a journey, not a destination.