Why is this surprising? In bulk, ROM is cheaper than EEPROM and I’m sure there’s a good amount of USB-related functionality or logic that can be stored there. It’s not a passive device by any means, so I’m not sure why there’s the implied “where it shouldn’t be” in the thread/title?
Indeed... Ryan Ringo (@ringoware) is an experienced reverse engineer. I assume other USB2Serial ICs have been reversed in the past, so I am curious to why he regards this as "something unexpected". I guess we'll find out once the bit extraction is completed.