Depends on the MCU
You can typically transfer control to code anywhere, including the ROM, what it does and whether it comes back are a whole different thing.
They do generally assume the ROM is mapped at ZERO, the SCB->VTOR points at it, interrupts are enabled at an MCU level, you that you don't have random peripherals and clocks initialized, and interrupts firing from those or system handlers..
You can surely write your OWN code to provide for update methods which don't need to follow ST protocols, unless there's some prescient reason to do so.
Writing your OWN user facing applications also allows you to control and support that experience.
