Generally, unless a similar license or legal terms are required to be agreed to by the end user, nothing stops the end user from reversing said binary blobs. But before you attempt this, be sure you fully understand every legal document which was presented to you by the device vendor. Click-through EULAs included.
It won't be identical, but as long as the A->B test loop can be closed I've had 100% success rate.
RF is a world of black magic, especially at the frequencies, symbol rates and encodings used for stuff like RAM. And the higher in frequency you go... the less "conventional wisdoms" apply.
There's in fact a very old article from 2007 [1] describing the issue from the other end. Some researcher tried to have a primitive form of what we'd call "machine learning" a few years later write FPGA bitstream to get a tone discriminator. Turns out the algorithm and test harness got a working bitstream... but it made no sense at all, it was very finely tuned to individual physical characteristics of that chip.
Link training blobs on modern chips do something very, very similar, at each link initialization they evaluate a lot of different parameters per pin to account for the current state the device is in to get the best (i.e. highest stable bit rate) possible link. And the parameters, value ranges and timings all vary between different chips, so if you write a blob for one combination of SoC and memory, it might very well be possible that you need an entirely different blob for another combination. And that is what the BSP vendor does and what is inside the blob... a tuned version of parameters that this specific board's firmware can use to achieve a working good link in the shortest possible time.
It's one hell of a ride that Flipper is on, and I seriously wish them all the best. There's a darn good reason this stuff has been proprietary, at best you'll get a high-level summary like [2].
[1] https://www.damninteresting.com/on-the-origin-of-circuits/
[2] https://www.ti.com/lit/an/snla415/snla415.pdf?ts=17793056953...
You need a testing lab with easily 500k worth of gear and construction cost if not way more than that to probe the data buses and obtain the parameters, we're talking about 1.6 GHz (RAM) or, and here it gets dark, up to 16 GHz (PCIe) frequency here. A scope alone that's capable of digesting such signals runs north of 250k from what I hear, you need calibrations, test probes, the room needs to be extensively shielded in order to not get disrupted by RF emissions of, say, the microwave two floors away.
And the people needed to do that are short in supply. As said, RF is dark arts, and I'm a mere radio amateur - I know people who do own such class of hardware though. They make bank. And I stay away as far as possible from anything higher frequency than LoRa. Don't got the brains for that.
