They probably can many things but I think things like memory timing is something you can't just easily reverse engineer from a blob. You need to test every state that the device can be in and see how the blob responds which is quite difficult.

Why not? Those timings and general initialization are inside the blobs?