I wonder why they couldn't just add a "malicious" (from the perspective of Samsung) binary into the partition on the flash chip to gain shell access that way which would allow them to interact with TrustZone and decrypt the main firmware image.
Cracking the TV's TrustZone would be a huge side project, akin to cracking the same secure enclave on all new Samsung phones and watches. Having said that, it actually has been done before:
