@nprofile1q... @nprofile1q... @nprofile1q... It happens very late in the boot process after the boot is considered successful. It can complete before unlocking but it's common to have time to unlock before it finishes. It's asynchronous and doesn't block the booting process.

The OS disables automatic rollback prior to updating the anti-rollback values for both the OS and the firmware. For the firmware, it triggers updating fuses to the current value in the firmware rather than a specific hard-wired value.