@alecxs Rollback protection is enforced by all the devices today as paet of the specification of AVB 2.0.

@defalt rollback protection (for encryption) is realized with version binding (which is enforced with Oreo). rollback resistance is a feature in Keymaster for secure erase keys from TEE. Rollback protection (for bootloader/ROM downgrade) is yet another feature. These are three different things. Most likely they are enforced all together, but don't mix up