Here is a feeling :
With all the recent fakers, we still don't know how to downgrade a PSP, but we know how to brick a PSP. A PSP is bricked when the firmware is corruped. This may happen if you shut it off while flashing the firmware.
I use to work on many PC BIOS. All recent EEPROM (where the BIOS is located) have a "boot block". A boot block is a small write-protected part of the EEPROM. At boot stage, if the unit finds the BIOS code corrupted, it will skip the part and load this small boot-block. Usually, the boot block is only able to reflash the main BIOS using only very simple access to device (no video, no keyboard, only floppy, for exemple). You just need a specially formatted floppy with a single file with a specific name.
I'm working on many firmware like ADSL Router or DVD drive. They all have a boot-block in order to revert a hand-user flash error. If you brick the PSP and send it back to Sony, i'm sure they will not rework the EEPROM BGA and they have a way to reflash the main firmware with a kind of boot-block build into the main EEPROM.
To be sure, we need to check 3 things on a bricked PSP :
1/ Check if the boot-block try to read from USB
2/ Check if the boot-block try to read from MS
3/ Check if the boot-block try to read from UMD
I think there is more chance to find a read form the MS, that's easier with a small size of code like on a boot-block. With an MS Emulator, you will be able to see WHICH file it searchs.
More, there is no enough space on a boot block to implement security check...
PS : Check about boot-block on google to know more