I also struggled a couple of days. Then I realised that I had pretty recently enabled full SIP (0x0).
After I had changed to 0x3 (i think) I could complete the update.
I then changed to 0x0 again, no problem.
I might at least be worth checking.
Thank you for this tip! Since my Asrock firmware is *really* uncooperative nowadays (my Clover Shell doesn't want to take keyboard input reliably) EasyUEFI made the process much simpler. My next step would have been to use efibootmgr but now I don't have to. Excellent!