Actually bootloaders are not always as perfectly secure as they may seem [0]. For example, McBitter from postmarketOS is a low level reverse engineering contributor, who made remarkable progress on opening up the bootloader of Mediatek devices [1]. People who want to contribute on that level, check out the #postmarketos-lowlevel ("the kernel is high level for us") chat [2].

[0]: https://wiki.postmarketos.org/wiki/Firmware#Bootloaders

[1]: https://wiki.postmarketos.org/wiki/Mediatek

[2]: https://wiki.postmarketos.org/wiki/Matrix_and_IRC#Matrix