Apparently there's some kind of hook in the original Mac's/Mac Plus ROMs one can use to get your code loaded at boot time. Of course, the code has to be sitting in an eeprom (or similar) at the proper address for this to work, but if you're plugging stuff into the ROM sockets anyway, this shouldn't be a problem.

Click to expand...

I have no problem believing that as the ROMs were the only socketed chips on the motherboard to allow this, combined with the fact that engineers already snuck in a way to expand the RAM against Job's wishes. I'm sure Jobs even resisted a socketed ROM. Wanna bet the argument about potential bugs was made merely to allow the socket? While it was easy to spot a suspicious change to the hardware, spotting a "hook" in the ROM code would have been much harder for Jobs. This is likely how some of the CPU & RAM expansion boards work which have EPROMs that override the motherboard ROMs on bootup.