I've found/read/heard some rumors (also subject to me understanding it correctly), that seem to be correct, and make this new RP2350/PICO2, even more interesting and amazing.
Apparently, the additional RISC-V cores, don't add a significant amount to the transistor count. Because, its design/layout was simply fed into the 'designer software' tool, which just combined/optimized, the whole lot, together.
Since, bigger blocks like the Multiply 32 x 32 ==> 64 bits, and fast divider and stuff, could be shared between the core types, as the tool was smart enough to realize/handle the fact, that you could only select one CPU type or the other.
Which would mean, that attempts to glitch/hack/force the chip into some kind of 4 core mode, would fundamentally NOT succeed, as they share so much logic.
Also, the boot ROM, was not big enough to store the code for both CPU types. So, it only (or mainly) has Arm code in it. But, a special emulator (**VARMULET) is run on the RISC-V core, during booting, which emulates Arm instructions, so that it can share enough of the code, to fit it all in (128 KiB or kB, IIRC).
** =
https://github.com/raspberrypi/armuletAlso, the built in OTP, has flag bits, which allows one to permanently disable, core types, if you want. E.g. Eliminate (disable) the RISC-V cores, permanently.
I'm not sure, exactly why. Perhaps for security/reliability reasons, or maybe to allow them to be sold as different chip variants, for certain markets (possibly changing the Arm license fees, as well).
Additional rumors, are that there were/are fears, over very significant Arm license fee cost increases (for reasons). So, the RISC-V's could either be replacements or bargaining chips, to get the best licensing fees.
EDIT: Added name and link to emulator