I wonder if any of you with a flash clip would be willing to test out if zycast can be used to flash these routers? If it works, then that would help others coming after you since we'd have a way in without the flash clip. See Method to flash any NR7101 for code pointer and the instructions we got.
Sill risky without bootloader access for backup, of course. But I believe it's slightly better than having to replace the bootloader.
I blindly assumed this device support zycast - most ZyXEL bootloaders do. My EX5700 is quite similar, but unfortunately not running ZyXEL firmware or bootloader from stock.
Note that using zycast might overwrite both system partitions in one go, so there is no way back to original firmware unless you can download that somewhere or created a backup using a flash clip.