The next release of GrapheneOS will fix the upstream issue causing the Network toggle to disallow access for an app in secondary profiles when it's disabled in the Owner profile.
Going to be trying to fix some upstream limitations for IP address privacy in the near future too.
Conversation
Going to be keeping the 2nd layer of enforcement we added for the Network toggle based on the traditional approach. It's the same 6 lines of code for IPv4 and IPv6. Can be considered a feature. Still need the newer eBPF-based implementation working properly.
Lots more to do too.