> has an undocumented but wire-sniffable protocol for firmware updates - Has an undocumented blob execution feature used for testing of the unit after it was s

> has an undocumented but wire-sniffable protocol for firmware updates - Has an undocumented blob execution feature used for testing of the unit after it was sealed and glued. - Has a documented secondary bootloader (remote code execution by design) due to historical reasons.