In FRR 10.0 this feature is now enabled by default: https://frrouting.org/release/10.0/

bgp enforce-first-as

To configure a router to deny an update received from an external BGP (eBGP) peer that does not list its autonomous system number at the beginning of the AS_PATH in the incoming update, use the bgp enforce-first-as command in router configuration mode.

In order to exclude an arbitrary neighbor from this enforcement, use the command no neighbor NAME enforce-first-as. And vice-versa if a global enforcement is disabled, you can override this behavior per neighbor too.

Default: enabled.

Note If you have a peering to RS (Route-Server), most likely you MUST disable the first AS enforcement.

The default in FRR changed - we need to address this change in VyOS