I would think that the bootloader code wouldn't use any funky IP blocks - it's not some sort of driver code into which applications call, it's just a special ap

I would think that the bootloader code wouldn't use any funky IP blocks - it's not some sort of driver code into which applications call, it's just a special application that runs before anything else. It has to be able to talk UART (or some other interface), check signatures, and write flash. All of these the user code can do as well. There are many "user-space" bootloaders as well for various chips. The factory bootloader is only different in that it sits in ROM. For example, RP2040 ROM bootloader is here https://github.com/raspberrypi/pico-bootrom https://github.com/raspberrypi/pico-bootrom