If you can upload your own program which reads the bootloader and then clicks it out via the piezo then you can also do one which just displays it on the perfectly good LCD.

Failing that, the PortalPlayer chip inside must have JTAG capability so he could have opened it up and just read out the flash in a couple of minutes at most.

Sounds like something he did just because he could, not that it was practical. You can read more about it on the iPod Linux wiki.