I made the ROM writable by soldering a CMOS ram chip across the ROM (was it 16KB?) and any write to the ROM would end up in the RAM. A switch selected either the ROM or RAM to read from. On startup simply copy the ROM to the RAM and flip the switch.
After this operation, using 'The Spectrum ROM disassembly' book the world was your oyster. I modified the ROM routines for reading/writing those little tape drives and bypass copy protection, for experimental purposes of course :)
Decades later, I did (pre-)order and read "The ZX Spectrum ULA", which documents, in painful detail, the inner workings of the custom Ferranti chip that powered most of the Spectrum.
This really did drive home the message that, no matter how much I thought I understood the low-level workings of my Speccy, there were still many lower-level layers left to explore. Which, I guess, is the central lesson of IT...