The controller board uses an STM32F407. Nothing fancy. And it has swd pins with an unpopulated header.
Time to connect a debug probe to those pads, and see if you can dump the firmware?
Makes me wonder if the only reason the firmware isn't upgradable, is because they didn't bother adding some connectors? (of course that MCU could also have built-in USB DFU support, if the necessary connector and boot selector button was added)
Of course even with these limitations, you'd think that "send the board back for an update at the factory" would be a simple procedure.