Unfortunately this is almost useless info because nRF5x devices (unlike others e.g. STM32) have no default bootloader or ROM. So each FW can implement firmware upgrade differently and without knowing exactly what your device + FW support you will hardly hack it. Then there are indeed "hard" ways like dumping nRF51 flash and reverse-engineering the FW (there is bug in read-back protection so this is feasible even for unequipped "hacker") but I guess this is not what you want to discuss here...
Unfortunately this is almost useless info because nRF5x devices (unlike others e.g. STM32) have no default bootloader or ROM. So each FW can implement firmware upgrade differently and without knowing exactly what your device + FW support you will hardly hack it. Then there are indeed "hard" ways like dumping nRF51 flash and reverse-engineering the FW (there is bug in read-back protection so this is feasible even for unequipped "hacker") but I guess this is not what you want to discuss here...
