I might be missing something. I've seen other reverse engineering projects where they simply unsoldered the flash memory and read out the contents. Wasn't that an option?
This might not have been clear in the blogpost, thanks for asking. There are two storage locations on the PCB: the external flash chip, and the internal flash on the microcontroller. I recall that someone else tried to read out the external flash chip, but nothing interesting was found, only the image data on the screen. In this blog post, I read out the code that handles the RF communication and talks to the screen.