I tried to hack the firmware in the past, but without much luck. The scope checks signature of the file before upgrading. It also, afaik, checks version number and refused to downgrade it. If I remember correctly, the version number is in signature. I don't know how to create a correct signature.
An alternative way would be to get a root on the scope. That would unlock all the possibilities. But I didn't manage to do it either.
Having said that, options for this oscilloscope, imho, affordable. I only activated one or two options, plus one or two they gave for free. The only thing I didn't activate are support for automotive protocols. Don't remeber how much they asked for it, but it seemed expensive for me to pay for these options as I don't really need them.