Well he probably spent the time to map out all the signals between cache and PDS, Then spent more time by pulling the proprietary PLDs, and doing a logic scan, this type of attack is a good way to reverse engineer PAL/GAL devices.

But of course, this is only an educated guess. and educated may be a bit much. lol.