You can argue most bad people won't know about it - but I would say we can't really know.

I think the main problem is that people can be affected that aren't even using it, which is why it is such a big problem. You can't really hide it's GrapheneOS either, even just by virtue of the features available on the device, you'll be able to deduce what it is.

I understand the idea behind it but it simply isn't realistic to provide and can put people in danger - the very thing it's meant to prevent.

But also in your case criminals can threaten you to give access to bank accounts you don’t have.

When I say hide, again for 99% of the people. Splash screen, setting spoofing. Sometimes good enough is better than perfect.

And even if the attacker can see the other profile you can just say was your friend’s profile and it’s lost.

Or better, not sure if possible: export the profile in a file like veracrypt. Then when you need the profile import from this file and would restore the secret profile.