Intentional rollback wouldn't look any different than malicious rollback, ReFS will detect that this is a older copy of the volume. User can however configure whether they want to block or allow boot in case rollback is detected by ReFS.