A little update:

I thought I'd throw the ECU into boot mode and try reading it for fun.
All I got was junk of course.

I then took a closer look at the hardware daughter board itself.

The datalines for the flash are all directly connected. The address lines go through the Altera device which obvious decrypts the flash image.
The 8 pin device is a PIC MCU. I traced where it went and couldn't help but notice one of its inputs was connected to flash DQ4 - hmm, perhaps its there to detect the low signal used to enable boot mode?

I lifted the pin and tied it high through a resistor, then tried boot mode again.

This time the image looks to have been read just fine - NICE!

I wonder if I can now just reflash it to stock software using boot mode.

The additional address line is also connected to the Altera device, its totally possible it switches it to access other maps I suppose.

edit:

Compared the tuned file to my stock file and it all looks good. I can see the map changes, rpm limit etc etc.

I could do that, the soldering is pretty easy. The little daughter board is actually socketed so I can unplug it. Then I would need to desolder the PCB they have in place of the stock flash.
Or remove the PIC, remove the Altera and use 17 little wires to reconnect the address lines properly.

I'll do more experimentation once I receive my SOIC8 clip so I can dump the eeprom without soldering to the chip.

Scoped the upper address line today to see if the boot mode read ever accessed the upper half of the flash, turns out it didn't.

The upper address line is tied to the Altera chip though so I am sure there is a way to select it electronically. I lifted the address line and tied it high through a resistor and did another read in boot mode. This yielded a second tuned file, not as aggressive from the looks of it as the rpm limiter is still the stock 6600 rpm.

I also noticed the first file had a "NO READ" and "NO RETURN" in it, the second file did not.
I haven't tried reading either without using boot mode as I am sure its disabled in one of the flash images and likely also disabled in the second. I have also seen software that corrupts/changes values when you try reading via obdii.