There's a fun step you're missing - it's not firmware. We toggle on (presumably) engineering functionality already present in Canon code, which allows for loading a file from card as an ARM binary.

We're a normal program, running on their OS, DryOS, a variant of uITRON.

This has the benefit that we never flash the OS, removing a source of risk.