@GrapheneOS >It's also trivial for an attacker with temporary access to the phone
With physical access you are gone no matter what.

Only a fool would think it's possible to defend against physical access via software means - only physical denial of access will work.