For those comfortable with advanced networking and terminal commands, several "semi-custom" approaches exist:
: Many models use Broadcom or Mediatek SoCs with bootloaders that reject unsigned (third-party) firmware. Root Access