Very useful tear down, great work! Looking forward to your results after modding it.
I wonder if it would be possible to read/dump the firmware, the Nuvoton MCUs are documented well. They may have enabled a security lock, otherwise reading the firmware should be possible. After that you could...