FWIW I've reprogrammed edk2 2.06 on the carrier board's SPI and moved JP27 to 2-3 so that I can now boot 2.06 by default. The board boots faster than with 2.09 (i.e. about less than one minute) and the CPU frequency is correct. I once had a crash while touching some PCIe options in the BIOS but that's all. I count on leaving it like this for now.
Indeed I have not updated the BMC version, given that I wanted to unbrick the board before taking more risks, and was counting in the BMC to be able to flash the MMC code. Maybe that's something I should do next.
I must say that it's difficult for the end user to figure what versions are expected to be stable and which ones are not. After having bricked the board by flashing something I thought was stable, I'm becoming much more cautious about flashing now.
Also it's a bit sad that several tags were not produced as releases (e.g. 2.06.100.1). I tried to build the images myself and discovered that they can only be built by Adlink employees since they refer to internal hosts and stuff that's not available. So I think it would be very useful to periodically produce development images that some users could test (e.g. weekly). You'd get more reports about them, and by making it clear which ones are stable or dev, there would be much less risk that users flash a development image by accident (e.g. call them -dev, -experimental or -beta).