Now that it's morning, I can go into more detail with this:
1) It's legal as long as the user (the owner of the device) is responsible for the modification.
2) It's hard to explain to the users that they are buying an application that modifies the flash and that they take all responsibility over bricking their device (and voiding the warranty in the process). They are paying hard money to brick their device.
3) If the user updates his firmware, he would need to reinstall the application in the firmware.
The process would be the following:
a) I generate a EFI Firmware Volume containing the Boot DXE (Posts the OptionROM and sets the VGA regs and switches the gMux to the correct video card) and the Runtime DXE (provides the RS->QueryVariableInfo service) and possibly other goodies (say some not yet written filesystem drivers like NTFS, ExFAT, EXT4, ZFS, etc.).
b) The user runs the setup application that sets the correct NVRAM variables and adds the Firmware Volume as an EFI FFS File in main Firmware Volume.
c) When the machine reboots, the DXE dispatcher automatically loads the Boot DXE and the Runtime from the Firmware Volume and runs them DXE _BEFORE_ loading the BootPicker. As a result, you can run Windows Vista SP1+, 7 and 8 straight from the original DVD.
While the process is clear, I'm not sure on the risks and I think that we should test on all possible logic boards and have a white list in the Setup Application of the logic boards that have been tested successfully and are confirmed working, otherwise I will not attempt this. The problem is that testing this requires testing the app on ALL post 2008 Mac logic boards and firmware versions and a few months ago when I counted them it was more than 50 logic boards, each with 2 or more firmware versions.
I believe you can understand why I'm hesitating.
The good news is that the Flash on most Macs is half empty, so there's enough room for this.
Furthermore, this method could be used to replace the bootpicker on each mac with a "Lion Recovery" aware one and to add AirPort card booting to all Macs (basically add the Broadcom wireless DXE to them). There are a lot of things that could be improved by editing the flash. You could take down the start-up time on a lot of Macs, clean the flash of duplicate files (some Macs have two copies of the discrete Option ROM), improve the bootpicker with Lion Recovery and Airport support, etc.