The toolchain would also be easier to match, unless they were using some proprietary compiler you can't get your hands on.
Just lookup how they match the toolchain, and find an agent harness to do decompilation.
I wonder if doing this kind of stuff with more recent software will cause more legal problems though. I am not really sure of the legal status of the resulting code.
Drivers can also be partially implemented / buggy depending on the device. (And I'm not talking about closed source stuff, even things like usb or touch screen drivers).
I would say that the major blocker is that nobody really cares about these devices and the task itself to mainline them is gigantic.
Most SOC have 3 or maybe 4 contributors maximum and the phonedev kernel mailing list gets a new patch only every 2 days. The whole phone mainlining community is probably less than 60 people.