I bet there is a magic sequence you can access the ram.
Maybe we have to ask the vendor directly on that
The flash is a standard 8pin serial SPI flash the company produces afaik, so it seems they just added a small chunk of code into the perpetual bootloader area which loads the ram from the flash upon hw reset. They also spent a spare SPI most probably for that (but bitbanging from unofficial hidden pins might be used too - see the picture - the flash pins are bonded to the pads so with a better photo you may simply fingerpoint the pin numbers).
Also writing to flash is redirected to the flash.
Maybe messing with a SPI_X not "officially" available for the specific chip may return some code?? A SPI_N+1 maybe
Or bitbang some hidden pins may show some activity??
Can we somehow read out the perpetual bootloader code ??
You can also sniff the Vcc line during the boot and decode the flash->ram boot sequences