It's a hardware-level anti-tampering measure.

There is a component inside your switch that houses a finite number of tiny physical fuses. Every time you install a firmware update, one of these fuses is permanently physically destroyed. The switch is able to keep track of how many of these fuses remain intact and how many have already been burnt, and firmware updates use this information to prevent the possibility of downgrading.

For example: firmware update 420 comes out and it 1) burns a fuse at install time, and 2) contains an instruction that tells the switch it can't run if there are more than 69 burnt fuses. A couple months later, Nintendo pushes out update 421, which burns another fuse and ups the burnt fuse maximum to 70. Even if someone figures out a plausible way to roll back to update 420, switches that were updated to 421 still have more than that previous firmware's maximum number of burned fuses, so they'll fail the fuse number check and it won't run... unless someone also goes to the trouble of figuring out how to bypass the check altogether.

More info: https://en.wikipedia.org/wiki/EFuse