Update
I bought a parts MS2721B from alltest that had the suspect flash ICs with the bootloader on them.
I also bought a Xgecu T48 universal flash programmer with the BGA64 socket.
I removed both BGA flash IC's from the parts unit, popped them into my programmer. Downloaded the contents from the flash and saved them. (I will post the flash contents on my website (neonkev.com), but if you need sooner please PM).
I then removed the flash ICs from the bricked unit. First, I read and compared the contents to the "good" parts unit. Indeed they were different.
So I erased flash from corrupted unit, and reflashed them with the contents I grabbed from the parts unit.
Reballed the BGAs, put them back on the board, and viola! Unit was able to reach bootstrap.
I use Anritsu MST to do an emergency recovery over LAN to reinstall OS. And everything is working again.
I learned a lot and it was a good experience. Hopefully if anyone else has a bricked bootloader, you can make use of this.
Of course, BGA reballing isn't the easiest type of soldering, and you need to spend some $$$ on the programmer. So not a quick fix.. but once you have the tools, the next repairs will only cost you time