I could reproduce the issue, but it'll be a bit tricky to solve - we probably should rework bootloader update handling in the LE settings addon (which is quite a mess).
The problem is that rpi-eeprom-update embeds a timestamp in the .sig file, and as the systemd service runs prior to time being set via NTP it'll be before the "current" eeprom timestamp and thus the bootloader skips self-update when booting from USB.
Just ssh in and run "rpi-eeprom-update -a" as a workaround for now, this will work fine (at least if system time has been set via NTP).
so long,
Hias