As it is in ROM (inside the RP2040), removing it might involve a Focused Ion Beam machine ;-)...

Of course, is there no way to flash the firmware?

It is in the boot ROM; not in flash memory.

What are you trying to say here? Please have a look into the RP2040 data sheet to understand what "boot ROM" means. It is not programmable!

https://datasheets.raspberrypi.com/rp2040/rp2040-datasheet.p...

"A 16kB read-only memory (ROM) is at address 0x00000000. The ROM contents are fixed at the time the silicon is manufactured."

I am just interested not trying to argue, found this link. https://wiki.segger.com/Raspberry_Pi_RP2040 The RP2040 includes a boot ROM which needs to be executed after reset in order to guarantee proper functionality. In case of a valid application has been detected in the external QSPI flash, the boot ROM copies the first 256 bytes from QSPI to SRAM5. In the RP2040 user manual, this code is called "flash second stage" (2nd stage bootloader) which is not part of the boot ROM but is part of the application image thus can be adapted by the user. The J-Link performs a device specific reset which halts on the first instruction at address 0x20041F00 of this so called "flash second stage" (bootloader).

The quoted description is correct. The boot ROM loads code from flash: the "second stage" loader. That loader then (usually) configures the RP2040 to execute the actual application directly from flash.

But the "Easter egg" function discussed in this HN thread is not inside any code loaded/executed from flash. It is inside the boot ROM (as I've repeatedly stated); and that is indeed read-only memory, i.e., it cannot be modified except by manufacturing a new chip revision.