The PSP uses certain measures to tell an update from a downgrade...surely.
Can't an application be created to trick the PSP into think a 1.50 downgrade is a update to 3.51? The PSP must scan something whether it be coding or a certain serial code.
One could modify an official E-Boot update to contain an OE or just be plainly a 1.50 installation...
The PSP manual does say you can update via a computer, surely one could edit the coding of an E-Boot to contain an OE/1.50 installation instead.
Just a theory...The E-Boots must have some sort of serial that the PSP scans to be official. Or maybe, when can mess with the Online Update *Via files on the PSP FLASH0 or whatever uses the online update* to link to a OE file or 1.50.
I have more idea...but I'd crash your servers if I posted them all.