The firmware and configuration are already split into several devices. These machines have Arm Cortex A9 and similar processors that go through several stages t

The firmware and configuration are already split into several devices. These machines have Arm Cortex A9 and similar processors that go through several stages to start up: First, some internal boot ROM, likely with fuses burned in for the particular IO configuration, reads a bootloader (likely Das U-boot) from external flash memory. That first-stage bootloader initializes the parallel/SPI NAND/NOR flash interface and DRAM controllers, and then launches the second-stage bootloader. The second-stage bootloader uses those memory controllers to read the firmware image out of memory into RAM, then executes it. If you want to update the firmware - more precisely, to change the location or signature of the image that should be loaded by the second-stage bootloader - it would be trivial to add a check for a GPIO switch to allow or deny changes.