Why though?

UEFI firmware cannot meaningful do boot counting - basically only if it fails to load the PE binary it can move to the next, but that's a very limited scope of automated fallback, that covers a filesystem/binary corruption case, but that's about it. We can and do much better than that, with initrd/userspace also playing a part on it. So for example if the initrd fails to unlock the rootfs you also automatically fallback to the previous version.

This is not just theoretical, the NIX folks showed a working demo at FOSDEM, it's a lightning talk, check it out: https://fosdem.org/2024/schedule/event/fosdem-2024-3045-a...