ro.secure
Does setting ro.secure=0 in the boot.img enable the phone's fastboot?
Or is the phone's fastboot a bootsector bootloader (1st stage) feature?
If it's the former, setting ro.secure=0 enables phone's fastboot, then
isn't it possible to simply:
root the phone
>adb shell
#flash_image boot...