“You could even spawn a process to remove the pam_duress module so the threat actor won’t be able to see if the duress module was available.”
Type the second password and you get a normal login while scripts quietly wipe data, cut network links or send an alert. It is built for the moment a government agent demands you unlock your machine. The weak point is the person demanding access. Anyone who knows duress passwords exist will image the disk before asking for one.