Couldn’t GrapheneOS provide a special pin which boots into an “empty”session? Where the user can install some default stuff to not look suspicious?
forensics will reveal the other partition(s), and then you're in the exact same position having to answer "what's the other partition, provide the password"