That's an example of why you should use public key cryptography for loading data from untrusted source.

AES is symmetric which means any encrypted payload need key used for encryption for decryption.

Which means it is on device, just need to dump it. And you can now use same key to encode new firmware