GrapheneOS does block SO_BINDTODEVICE when VPN lockdown mode is enabled. It doesn't yet block apps in profiles not using a VPN in lockdown mode from using a VPN in another profile due to compatibility concerns but we can likely block it.