I'm currently working with the teensy 4.0 and I heart that it uses a proprietary bootloader.
So my initial thought were to dump it and reverse it, to see what's going on.
A little bit info to the teensy 4.0 It uses the iMXRT1062 from NXP, the bootloader isn't even stored anywhere in the main chip's memory. It is permanently stored inside the separate MKL02 chip. You cannot use a JTAG/SWD debugger, because (if I have understood it correctly) the external chip uses this to write the program to the chip's flash memory.
My goal is to write some bare-metal-drivers for simple usage and I thought this would be a cool challenge ^^