Correct me if i'm wrong but its not even exploiting some firmware bug or anything.
Think there is a 'plugin interface' in those firmware that exposes whatever is needed to read the raw data so all it does is uses that interface to dump data instead of using the official calls. IIRC its why the read speeds are slower.
Source: some post on the same forum couple of years ago.