Sonoff M5-3C-80W light switch from Matter to ESP32 - is it possible to change the firmware?

.
Matter's M5-3C-80W three-channel wall switch allows direct or remote (via WiFi) control of three receivers and works with the eWeLink app, in addition to offering Matter protocol support. It is distinguished by three "clicking" buttons, which is a nice change from the ubiquitous touch solutions. The whole thing is available to buy for £80 and is built on ESP32. Here I will show its interior and see if it is possible to upload Tasmota to it?

Let's start with the packaging - the markings make it clear about Matter:
.
.
Now the contents of the kit:
.
.
Immediately striking is the unique QR code from Matter. Instructions:
.
I've already presented the eWeLink application, and I plan to cover Matter separately, so now it's time to present the interior.
We remove the top cover:
.
Here it is slightly different to the Tuya products. The front panel is also removable, but here it is separately completely enclosed in a plastic housing.

The ESP32-DOWD-R2-V3 is directly on the PCB, right next to it is the Flash memory with its program. We also have a programming connector here and a 3.3V LDO providing power. I also see additional transistors - I wonder if they are from controlling the relays on the other PCB, or something else? Let's check.
.
.
The executive board can still be viewed:
.
Here, however, I see transistors from the relay control (J3Y as usual), so those must have been from something else. Apart from that, I see the main inverter controller here - LP3667.
.
.
The rest of the circuit is fairly standard. The relays are on 5V (FANHAR W18-1AST), so the power supply must give 5V. Then only the LDO provides 3.3V for the ESP. In addition, I was positively surprised by the presence of a CY capacitor (so it's a flyback topology, not a non-isolated inverter) and a varistor and filter capacitor at the input. Sonoff does not save as much as Tuya.

Time to try changing the firmware.

I started with the esptool approach. I connected the RX, TX, power supply and GPIO0 as standard. Unfortunately - the ESP is locked:
.
In the end I gave up and only did a memory dump on the CH341 programmer. It won't do much, as the ESP verifies this program anyway and won't run a "foreign" batch, but maybe someone will find it useful for analysis.
.
A copy of the batch is available on my repository: https://github.com/openshwprojects/FlashDumps/tree/main/IoT/ESP32

In summary , it looks like here we have an ESP32 protected from uploading new software. This is not new, there have been other Matter products presented on the forum and there was a similar problem. Fellow @divadiow also presented them in several topics. It seems that here the only option to change the batch is to swap the whole ESP. You simply have to solder out the ESP and solder a non-blocked chip in place, and that would already be QFN soldering.... well, I don't know if it's worth playing around with that much? What do you guys think? Or is it enough to use the manufacturer's cloud?