It requires a skillset which IMHO is actually not so rare particularly in parts of China and Russia, where hacking these systems is part of how all the unofficial repair shops can survive.

In fact I wouldn't be surprised if this particular task, extracting the boot ROM, was already done long ago by a few groups but not publicised --- Apple's bounties may seem enticing, but these people know it's the end if they tell Apple; they'd rather keep it secret and use those "holes" to keep investigating and sell their results to repair shops, which may ultimately yield far greater profit.