I thought the “semi-on” state with the battery display was still just firmware and not full iOS. If not, what exactly is it booting to display that? Surely not an ordinary kernel?
My experience is with the MTK platform but Apple may be similar; in which case the battery display is done by neither "firmware" nor the full OS, but an intermediate component:
I believe they are just one of the things you can "boot", alongside regular iBoot in the boot partition and loaded appropriately by SecureROM. I'm pretty sure the images at least ship inside IPSWs.
This is correct. That's because the "Charging" screen also sometimes has OEM or carrier branding on, and error messages that might need to be i18n translated eg. "battery failure", "overheat". It's much easier to do that with a separate component rather than give every OEM the ability to flash and recompile firmware.
