FoodGenius

as a quick and dirty workaround... without rebuilding the bootloader images....  i fiddle with uboot "switch" command
 
switch phy_write 1 0 0 0xffff  
to disable the ports at boot, just by prepending to bootcmd variable. so even if there is no microsd card available or filesystem or kernel image is corrupt, the ports gets deactivated and no traffic ist forwarded.
so you can use
 
setenv bootcmd 'switch phy_write 1 0 0 0xffff;for target in ${boot_targets}; do run bootcmd_${target}; done'
 
but the "2 seconds timeout prompt" is still there, so you have a small window of 2-3 seconds at boot time, where lan/wan still gets forwarded/bridged.... and if uboot itself hangs (memory timing or instability of powersource ).. there is still the problem of forwarding traffic until manually triggered hard reset or shutdown.
 
also if you enter the uboot console, switch forwarding is still active. so your first command in console should be.
 
switch phy_write 1 0 0 0xffff

if you dont won't to set wan port down, use 2 or 3 for the lan0 and lan1.

switch phy_write 1 0 0 0xffff -> WAN
switch phy_write 2 0 0 0xffff -> LAN0
switch phy_write 3 0 0 0xffff -> LAN1
 
Update: @Igor perhaps you want to mention this alternative bootcmd var at the current armbian infopage?
https://www.armbian.com/espressobin/