Based on the same boot-loader in the Canon 80D, one of the firmware files is supposed to probe the camera in a first attempt to find the address of the LED light as a marker (and more). Once the LED flashes, that gives away the address of the GPIO attached to it and thus the first stage of controlling the rest of the camera can begin – executing more code on the processor can be attempted in the normal way. The file also tries to probe registers that are present on other Canon bodies, with the results being noticeable on the LCD if they do anything on the EOS R.
The videos below show the proof of concept. Kudos A1ex!