I ran into this with my Pixel 7 Pro before. While it was more likely to happen during an update, it was something I could trigger eventually just by rebooting continuously. (And much more frequently if I alternated between booting into Android, recovery, and rescue modes.) I was not able to reproduce the issue with the stock OS.
Since it's almost certainly a bootloader bug, I started comparing GrapheneOS' AVB setup with the stock OS' AVB setup. The one notable difference is that GrapheneOS puts the boot-related hash descriptors directly in vbmeta, while the stock OS signs those partitions directly and puts chain descriptors in vbmeta. What GrapheneOS does is perfectly valid, but it ends up using fewer rollback index locations (1 in GrapheneOS, 5 in stock). Maybe the bootloader has some obscure bug that doesn't deal with this scenario properly.
I ended up rebuilding and resigning GrapheneOS' partitions to more closely match the stock OS, but unfortunately, I couldn't finish testing before the deadline for sending in my device for a trade-in.
For folks running into this after an update, the automatic rollback after a few reboots should resolve it. If you're unlucky enough for it to happen just from a regular reboot, try booting into recovery and sideloading the latest update. If recovery mode also doesn't boot, try rebooting into rescue mode and sideloading with adb rescue install <grapheneos zip>.