Comment 1 for bug 1933826

Fedora doesn't use grub-mkconfig after the initial install, but drops https://www.freedesktop.org/wiki/Specifications/BootLoaderSpec/ files into directories, so it's not entirely surprising their behavior is different.

I'd say at the moment bootloader passwords are unsupported as IIRC, there are issues with keyboard not working correctly in a bunch of places. The use of them seems limited, given that you can just remove the config entry given physical/pre-boot access. And encrypted /boot, AFAICT, is also not supported.

Option 2 is a no go that might cause unbootable systems as you might end up with an empty file in a crash.