The v4/v5/v6 models come with two bootloaders. One meant for emergency recovery and the regular one. The factory image only includes the regular one I guess.
I suspect this is because it's using the same offset in the source and destination when copying, but it does skip over the first part that contains the recovery logic.
There seems to be more information in the forum thread on the v4. See for instance this post on the partition layout being shifted at the cost of the rootfs, probably to accommodate the recovery logic:
And this explanation around the addition recovery part and wrong offset being used from v4 onward:
I guess the device looks for a bootloader starting at address zero. On v3 that used to be the bootloader just as it came from the stock image, on v4/v5/v6 that is the recovery bootloader that jumps ahead to the second bootloader at address 30000 if all is good. As you don't have the recovery logic anymore, you could try putting the regular bootloader at address zero just as the v3 had it. I don't know if the image to be flashed need to be aware of its partition layout or not. (It seems that not as somebody managed to boot a v4 image on a v3. Otherwise you could try flashing a v3 image and only 5 GHz WiFi would not work.) There is also a comment in that v4 thread about dropping the recovery part and reclaiming the lost space for the rootfs. Maybe you could get that to work.