Pico just uses 3040 JSVars

if we can't split the f/w up, there'd have been at least one wasted 16k page.

True - it's a bit of a waste using a 16k page for firmware anyway. It would have been great for a fake EEPROM though.

Doesn't the firmware tell the bootloader where the data needs to go?

Afraid not. The bootloader starts first (so the board can't be bricked) and the jumps to a location - that location is the problem - it's at the start of the 64kB page. If we could keep the vector table at the start of the 64kB page (placing the saved code before and after it) we could still do it without changing the bootloader - but wow, it's a big hack :)

... it also makes it way more likely you'd need to reflash the firmware if there was a glitch while saving code... In fact it's worse than that, because I think right now the vector table is used straight out of flash, so the second you erased the page the device would lock up.