But as far as I understand, (when there's no A/B) recoveries just modify the recovery partition, which isn't protected by dm-verity.
So if you install just a recovery, it doesn't matter?
If I got it right, with A/B the recovery has become part of the boot partition. If dm-verity protects that...