I’ve checked with developer.
We don’t support Debian update with rootfs_ab enabled.
The root cause is that Debian only can update the current slot filesystem, but the bootloader is updated to the non-current slot. Since it always unified bootloader A/B slots with rootfs A/B slots, after apt upgrade and reboot, the bootloader and rootfs will switch slots, then the bootloader is new, but rootfs is old.
This is unexpected, so we have to disable the Debian update with rootfs AB enabled.