I wonder when our Operating systems get some kind of „dual boot“ mode which can be used up hide private info, while being undetectable by even more than cursory examination.
Ideally you'd use credential derived encryption for each user's storage area on the device, and avoid leaking the number of profiles on the device. The UX for that is "hard" - even a single login screen that (with a naive implementation) accepts 1 of N PINs would be vulnerable to a timing attack as the PIN is tested against each "profile".
There's a few gotchas around carrier services like SMS and voice calls (do these go only to the main user account?), but maybe in future you could see an eSIM per profile... Doesn't protect you against a colluding mobile operator though - ultimately it all comes down to your threat model.
If your adversary knows about work mode though and checks if it's available, this won't help you much.