Most of this is over my head but when doing pre-purchase research, I was looking at different u-boot setups. The Xiaomi Mi Router 4A thread may be helpful. I think most boot loader partitions are mounted read only. In that thread, initial access to the boot loader was gained by copying the partition, using a hex editor to change the boot delay and then using mtd to overwrite the partition. A backup of the original, unedited boot partition would be prudent.
https://forum.openwrt.org/t/xiaomi-mi-router-4a-gigabit-edition-r4ag-r4a-gigabit-fully-supported-and-flashable-with-openwrtinvasion/36685
I've seen this likened to a nuclear option and it is considered risky.