What is the proper way to change Macintosh HD icon used on Mac Startup Manager with FileVault2 enabled?
Note: Not all icns files are compatible with the firmware installed in your Mac. You may need to convert an icns file to a different format before the file will be recognized by the firmware.

You first need to determined the identifier for the APFS Preboot volume from the output of the command diskutil list. Below is an example.
/dev/disk1 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +898.0 GB   disk1
                                 Physical Store disk0s2
   1:                APFS Volume Muskie                  32.2 GB    disk1s1
   2:                APFS Volume Preboot                 120.5 MB   disk1s2
   3:                APFS Volume Recovery                1.0 GB     disk1s3
   4:                APFS Volume VM                      8.6 GB     disk1s4
   5:                APFS Volume Snapper - Data          741.9 GB   disk1s5
   6:                APFS Volume Snapper                 11.2 GB    disk1s6

From the above output, the identifier for the APFS Preboot volume is disk1s2. If you have a different identifier, then make the appropriate substitutions. Enter the following commands to copy the icns file to the Preboot volume.
diskutil mount disk1s2
sudo cp /Users/admin/Desktop/icon.icns /Volumes/Preboot/.VolumeIcon.icns
diskutil unmount disk1s2

In the above example, there are two versions of macOS installed in the container. The Muskie volume has High Sierra installed. The Snapper and Snapper - Data volumes have Catalina installed.  When booted to the Mac Startup Manager, the .VolumeIcon.icns file, stored in the root of the Preboot volume, is used to display the same image for both operating systems.
If you wanted different images in the Mac Startup Manager for each version of macOS, then you could install both versions of MacOS in different containers. Or, the same container could be used, but I am not sure if this would work when encryption is employed. An example is given below.
The previous example used the /Users/admin/Desktop/icon.icns file. In this example, this file is replaced by the two files High Sierra.icns and Catalina.icns stored in the Desktop folder of your Catalina account. Images of both files are shown below.
 
The following steps could be used to install the icns files.

Note: You do not have to disable SIP.


Boot to Catalina and enter the commands given below to remove any existing .VolumeIcon.icns file from the root of the Preboot volume.
diskutil mount disk1s2
sudo rm /Volumes/Preboot/.VolumeIcon.icns
diskutil unmount disk1s2

 

Enter the following command to install the image for High Sierra.
sudo cp &quot;$HOME/Desktop/HighSierra.icns /Volumes/Muskie/.VolumeIcon.icns

 

Boot to High Sierra and enter the command given below to install the image of Catalina.
sudo cp &quot;/Volumes/Snapper - Data/Users/$USER/Desktop/Catalina.icns&quot; /Volumes/Snapper/.VolumeIcon.icns



 
Update for Big Sur
The Preboot volume is already mounted at /System/Volumes/Preboot. To change this volume while using macOS Big Sur, first you will have to disable SIP.