GBowler My understanding is that for Macs up until around 2017 (where I am focusing my research), the firmware/ROM is on a ROM chip which is accessible for read/write using a diagnostic port on the motherboard and a special cable and programmer. So, you can dump the ROM, extract the necessary parts and inject them into an older ROM update file (from Apple), then flash that back to the motherboard. I have done this a few times. Notably, the main firmware/ROM is only one component of several which can be updated, but this is where I have focused so far.
For later Macs, my understanding is that BridgeOS runs on the T2 chip, and like an iOS device you can only flash an older BridgeOS while Apple is still signing it (so only recent versions). I believe the firmware/ROM resides on the main SSD with the OS and user data, but the NAND flash is encrypted by the T2 so I do not see how you can manipulate it (other than perhaps erasing the entire NAND flash chips). You can use Apple Configurator 2 to "revive" or "restore" the firmware and operating system, but again, only recent versions still signed by Apple. So, I am curious if this person can actually flash an older firmware version on a T2 Mac, and whether that includes the BridgeOS.
