Everyone complains about locked bootloaders on phones. From reading the bootloader seems to be code stored on the partition which /boot is mounted. Once the phone is rooted why couldn't one just delete what's on /boot and put their own stuff there. When you do an OTA and it update the boot loader I assume it just writes files to this partition.
In a Linux distro I can replace grub which is stored in boot with LILO or whatever by simply replace the files in /boot and write the PBR to the head of that partition to then boot into LILO. When the PC boots it looks at the MBR which tells it to look at the active partitin (persumably the one with /boot), chain into that and read the LILO code at the head which then does stuff with all the other files in /boot.
How do android devices boot differently that prevents that?