Nokia 7.1 won't boot after Google Security Patch update
It is a fairly common sight on a "Nokia 7.1". Did you try this tutorial already? The slots can essentially take you 1 version behind and you can then try booting. Sometimes that works (as in the comments sent by many). And since you want to preserve your data, there's even lesser chance that it will work, but it can.

If not, what you can try is to go one version behind (by changing the boot slot -- fastboot --set-active=a or b as needed) and then try to sideload the latest update via recovery again. As with updates, they can only take you forward and not backwards. The 408F is the newest update for the phone and you cannot find an update newer than that. When you'll change the slot, you'll be on 408E and then the 408F should install just fine. 

As about your question about how the update got installed, it's the beauty of A/B devices, but the issue isn't with installing the update, it was done successfully. The issue is more of the device not managing to get its encryption running after the update has finished installing. The system feels that the update was successfully installed, but the phone clearly knows that something went wrong with the data encryption/decryption process.

In case changing the boot slot and then installing the update doesn't help, then you're left off requiring full firmware installation. You can send to Nokia or buy a remote flashing service. If you still haven't done a reset until this point, then the service can try to help bring your phone to a bootable state where you can backup your data.