eSIM usage requires sandboxed GP on the owner profile, and I like the ability to hold the power button and "log out" of the guest profile.

If you put your sensitive usage on the owner profile you wont be able to achieve full disk encryption on that usage without shutting off the device.  

 I put sensitive on owner profile. Meaning i csn not gice up pin code. Need to change so i csn give up pin code and still be fine. Meaning sensitive on profile 2 only. 

 set-up changed based on your recomendation