It might be patchable, even though it's in ROM. The ARM chip I've been working on has a mechanism to change a few words in ROM by blowing fuses... basically, between the ROM and the CPU sits a device that compares addresses and if matches what's found in the fuses, will replace the data being read. Since it doesn't have to be fast (since ROM code is only used at boot and there isn't a lot of it), they can slow down memory access to get more security.