Kernel update insists on trying to create symlinks in /boot even though /boot is vfat

The focal (20.04) kernel updates 1042 and 1043 attempt to create symlinks in /boot. This was tested on a Pi 4 (arm64) On Raspberry Pi, /boot is a vfat partition; vfat does not support symlinks.

This problem manifests itself as:

$ apt-get upgrade

[...]

Setting up linux-image-5.4.0-1043-raspi (5.4.0-1043.47) ...
/etc/kernel-img.conf: W: ignoring no_symlinks; only symlinks are supported
Processing triggers for linux-image-5.4.0-1043-raspi (5.4.0-1043.47) ...
/etc/kernel/postinst.d/initramfs-tools:
update-initramfs: Generating /boot/initrd.img-5.4.0-1043-raspi
Using DTB: bcm2711-rpi-4-b.dtb
Installing /lib/firmware/5.4.0-1043-raspi/device-tree/broadcom/bcm2711-rpi-4-b.dtb into /boot/dtbs/5.4.0-1043-raspi/./bcm2711-rpi-4-b.dtb
Taking backup of bcm2711-rpi-4-b.dtb.
Installing new bcm2711-rpi-4-b.dtb.
ln: failed to create symbolic link '/boot/dtb-5.4.0-1043-raspi': Operation not permitted
run-parts: /etc/initramfs/post-update.d//flash-kernel exited with return code 1
run-parts: /etc/kernel/postinst.d/initramfs-tools exited with return code 1
dpkg: error processing package linux-image-5.4.0-1043-raspi (--configure):
installed linux-image-5.4.0-1043-raspi package post-installation script subprocess returned error exit status 1
Errors were encountered while processing:
linux-image-5.4.0-1043-raspi
E: Sub-process /usr/bin/dpkg returned an error code (1)

Even when /etc/kernel-img.conf is set to:

Kernel Image management overrides

See kernel-img.conf(5) for details

do_symlinks = no
no_symlinks = yes
do_bootloader = no
link_in_boot = no

dont you need sudo ?

Despite the $, apt-get is being run as su. It wouldn't get nearly so far otherwise.