as seen in the highliest rated answer in your link, the failed service is not a real problem.
I usually tend to just mask that service in checkmk.
In the ruleset “Systemd services summary” you can exclude it with the following parameter:
Exclude units matching provided regex patterns: fwupd-refresh
i got the same problem, since i upgraded the system from 2.3.0p12 cee to 2.3.0p27 cee a few days ago.
However, if i create a “Systemd services summary” rule to mask this problem it wont work.
The service is still marked as critical.
The only difference i get is that checkmk wont show which systemd service failed but that one is failed.