And then what? A/B update isn't magic dust, if some sub component ends up with an incompatible firmware because it had to boot to the alternate partition, you might still have an incompatible overall system.

(Not like the subsubsupplier of that module even specced the extra flash memory for A/B update, hah)

Retain the known good firmware for each controller on master disk A, if the update fails, reflash all components.