eSIM usage requires sandboxed GP on the owner profile, and I like the ability to hold the power button and "log out" of the guest profile.

If you put your sensitive usage on the owner profile you wont be able to achieve full disk encryption on that usage without shutting off the device.