The Gameboy Advance in particular is pretty fun and simple, I recommend it.
When the CPU boots up, there is a special temporary mapping for $0000-$0100 to the firmware. The firmware largely just validates the ROM header and displays the Nintendo logo. But my favorite part is this: it executes all the way to $0100. There is no jump to $0100 - the last two bytes are an instruction that simply removes the firmware mapping. Now the IP lands on $0100 and everything is mapped as expected.
This simple mechanism made it notoriously difficult to extract the Gameboy BIOS. I recall reading that one way it was eventually extracted was via fault injection: by messing with the clock very precisely, you could get the processor to 'skip' the instruction that unmapped the firmware, thus allowing you to dump it.
Of course, another way you could read the firmware is by "simply" decapping the processor and taking shots of it with a powerful microscope, and then optically extracting the 'bits.' I think this was also done, but as a person with little understanding of the actual details of how a decapping is done it seems like an incredibly expensive, error prone operation.