Only thing is that the iPod firmware you're referring to is stored on the harddrive and is called from the flash firmware inside a chip. You never modify the chip when changing the iPod firmware. What you're now saying is that we take the firmware from the chip (cameras are not iPods), modify it and flash it back onto the chip. This is just as dangerous as directly editing it, because if it breaks the boot or firmware update routines, the camera will be effectively dead or unflashable. On an iPod you can do whatever you want because it runs the firmware off the harddrive (camera: SD). This is fine in an iPod because you can't swap the harddrive but you can swap the cards in a camera and even boot without one, so everything is stored in the flashrom.
Another thing is (your post is not entirely clear and open for multiple (at least two) interpretations) that we need to store the code we're running somewhere, so we can't just load the entire camera firmware somewhere. Not only will this increase boot times dramatically, it'll also eat a good 8MB off the 32-64MB generally available in cameras. Even if we manage to find free space that large, we still have to tell the OS not to use that part of the memory as cache/buffers, limiting the camera's functionality. Also, there are a lot of hard references to addresses in the flashrom so we'd have to modify them all, which is nearly impossible without FULLY disassembling the code, which is very hard because of the code/calling style used in the firmware.
