You misunderstand. I never said you could install self-made NPKs. What I was getting at was that after NPK has been installed, historically there have been ways of modifying or replacing components on disk, if you do it out-of-band. For example, first you install official NPK, then you directly edit the filesystem afterwards to replace the kernel image. Obviously this is beyond the average user’s skill set and requires physical (not remote) access to the router.
I also believe it is still true to this day that RouterBOOT does not sigcheck the kernel that it passes control to. Or if it does on more recent hardware, it didn’t do it on older models, and as long as downgrading to RouterOS 6.x is allowed on those older models, will likely never be possible on any RB hardware that ever shipped with an older RouterBOOT. For sure any PC with older BIOS architecture has no ability for the BIOS to signature-check the OS it is booting. On UEFI, of course, the rules change, but just about any generic PC can have its UEFI instructed to disable “safe boot” type measures.