Without looking at the chip's architecture, I would think the firmware is 'masked' or 'etched' onto the chip during manufacture, not blown on afterwards.  A very sophisticated lab could possibly look at the firmware, but it may be easier to ask the manufacturer for the details.