Thank you for the information and confirming my suspicion.
I have all the information to determine what fix is most viable for the production process.

Is it possible for secure boot v2 to disable the download mode before the flash encryption finishes? I have CONFIG_SECURE_DISABLE_ROM_DL_MODE enabled. From the description I'm reading that during the startup of my app the download mode is disabled. But I have devices that are unable to start the app...