@gnomealex@javierm nope. DDIs come with dm-verity. Hence regardless what they are stored on integrity is ensured on block layer before the fs data structures are processed.
And if they themselves are stored on a backing fs then sure you need to ensure some basic validity of that, but its relatively limited, i.e. even vfat suffices (which is probably where data structures are simple enough for security, because kinda mandated by uefi model around esp)