Preventing booting from unwanted/upgraded partition in Android
From AOSP A/B (Seamless) System Updates


Call update_engine with the HTTPS URL for your update package....
... If the update is applied successfully, update_engine will tell the bootloader to boot into the new OS on the next reboot....

(Emphasis Supplied)
So, you are looking at action being taken at boot loader level. And if you mess at that level dm-verity will kick in which is a kernel level protection that can't be tampered with once device leaves factory

If verification fails, the device generates an I/O error indicating the block cannot be read. It will appear as if the filesystem has been corrupted, as is expected.

With a custom recovery dm.verity can be disabled but then OTA will fail because it detects recovery change and frankly, if an attacker  can gain root access, the device is pretty much their's
Edit: See this for more details
A/B (Seamless) update device questions