I'm extremely late here, and also not at all an expert, but I don't think it's completely impossible.
If a low enough level exploit is found for a given fw version, then, hypothetically, we could have an updated emuNAND. SysNAND would boot properly using the real eFuse count. From sysNAND, we...