Any thoughts on whether or not this is part of the OTA update infrastructure? Seems like having the modem be able to put data into the file system at a particular place that the boot loader/flasher knows to look for would be a typical sort of "install firmware when the firmware is broken" kind of thing.
Wouldn't that assume the Linux userland was up and running when the bootloader wanted to update itself after rebooting? I don't believe that is the case.
In modern qualcomm devices the primary boot loader (PBL) can usually only boot from it's own area of the eMMC (embedded SD card essentially, but based on MMC 4.0 not SD 2.0), possibly from a connected microSD card, and from an authenticated (and probably signed) download over USB or serial. This is controlled by one time use fuses (called Qfuses or Efuses).
The PBL loads and authenticates the secondary bootloader, SBL/QCSBL which runs a more advanced version of the download protocol and normally will launch the userland bootloader. (I'm not sure where the modem software is started here. The SBL may very well support the same or similar RFS IPCs from filesystem access to the eMMC, though I don't know of any RE that indicates that.
Of course, a compromised firmware could also reprogram pins and bitbang the eMMC, or just use it's own MMC interface as the bootloader can, rendering much of this moot.
I'm sure saurik or comex could add a lot more to this discussion.
Typically these services are intended to allow the modem to access factor calibration data, possibly page firmware in, or to store nonvolatile information it needs longer term. They should be restricted to just storing data on behalf of the modem and not providing broader filesystem access (that's at the very least (assuming incompetence rather than malice) a bug).
This is certainly possible (also possible for the modem to leave instructions for the phone to perform a remote wipe, for example).
The other way around is also imaginable - where the modem temporarily stores new firmware on the RFS upon reception, before updating itself, to reduce its own (likely expensive NOR-based) flash memory requirements.
