Cool. The same hook for "test software" appears several places in the Plus ROM (128K ROM) too. It's literally the very first thing the ROM does when booting. If the long value at $F80000 is $55AAAA55, then it jumps to the address pointed to by whatever's at $F80004. There are three or four other similar checks during the boot sequences, at other addresses in the $F800xx range. I wonder what you'd do with that. I wonder how you could even add extra ROM that would get activated by memory accesses to that address range.

I think this would be most useful for some kind of temporary clip-on testing device containing extra software to do validation testing at the factory. If you want to permanently change the Mac's ROM-based behaviors, you're probably better off just replacing the ROMs.