Indeed, Ive shipped devices that provided canned boot sector data before - not as an exploit, but because the operating environment needed such in order to function. Of course, that was a from the factory thing, not a field exploit.
Yeah, that's exactly what THEY wanted you to believe

Just kidding. Or maybe not... Was that "canned boot" somehow easily replaceable with a different one afterwards? Ie: the canned boot residing in another area of the HD which could be updated or using a custom tool? Or just reusing all the developed firmware, replacing the "canned boot" and generating the payloaded firmware?
Well, the canonical example would be to package a disk with a 'paddle card' protocol converter which sits between the drive and the system's SCSI | ATA | Fibre Channel | 1553 | Ethernet | InfiniBand | whatever bus. The canned boot sector would be resident in the FW of the paddle card. Used for things such as allowing contemporary HDDs to be used as boot devices on legacy systems built before the dawn of large HDDs.