The rootfs size overrides IMAGE_ROOTFS_MAXSIZE

No because at that point you do not know if the new update is sane.

What you need to do is to somehow delay the extra reboot until the update has been committed. I’m not real clear on your use case so I can’t think of anything else to suggest.