It sounds like he already had linux running on the device, it just couldn't control/access everything, which was the ultimate goal of this project. So once you have linux running, even without being able to control everything, you have code execution. It seems like there'd be other ways to get the bootloader out, but I'm not familiar with the project, presumably he did the easiest thing he could do - or most interesting.
Considering spez has shown before he doesn’t really care for Reddit’s rules that are applied to the rable and he can do what he wants (like editing others posts), I fully expect the permanently blacked out subs to have new ownership and become public again before too long.