I may be able to resolve this, having hacked a bunch on M1N1 and such - the DFU port is going through a microcontroller with firmware.
That is why, for example, it can properly process USB-PD messages that contain vendor defined message codes, even prior to any form of boot, as long as it has any source of power.
The firmware on the USB controller is processing that.
This is how VDMTool works to be able to mux debug (and do other things) even with the machine otherwise off.
See my response to tpmoney - not all signals in the DFU port go to the port controller.
Then why is there only one port capable of DFU?