Comment by bri3d

In this case, by using fault injection to induce a glitch into a test mode which bypasses secure boot and loads code from SPI, combined with a SPI emulator (and I2C to send the boot vectors).

https://m.youtube.com/watch?v=cVJZYT8kYsI