User profiles like Private Spaces have their own VPN configuration, files, and their own credentials if you want that. In this example my Private Space runs a different VPN and a different instance of Molly (Signal) from a separate burner number not on my device. You could use it for Wallets, for using Tor, I2P, whatever you want. Realistically people use it to put Play Services and apps that use it in it when they don't want to put it in Owner.

GrapheneOS provides some improvements to it. You can have Private Spaces on secondary users, not just Owner. You can also toggle clipboard sharing including import/export control. You can also make it "End Session" on lock, which puts the profile at rest and securely powers it down.