OK, I see. Then the bootloader is in the external MCU, which runs it's own dfu and handles the write to the spi flash and then pass the execution to an offset in there. Also the fuses are configured to boot only from there, I guess, which means I would have to desolder that MCU and blah blah...