I want to use GrapheneOS without the ability to access the browser and without the ability to install new apps. At least without a password. A long one written down on paper would be enough friction for me. You could also give it to a trusted person. You can also write/give only a portion of a password and then memorize the other part.

Afaict there's not an effective way to do this like you can on iPhones with Apple Configurator [1].

Removing appstores from secondary profile and browser with ADB has a workaround (which I won't say in case someone uses that setup). Another drawback is enabling ADB is bad for security.

Dumbphones are stupid because they're overpriced, not secure, and lack awesome apps like maps or Signal. And I already have a phone.

[1] https://news.ycombinator.com/item?id=45171200 this is seriously great if you have an iPhone, I used to use it before I switched to GrapheneOS.