Well usually either people think dev/debug eboots or keys. Usually the argument for dev eboots is that they're all FSELF, i and a few other people have debunked this theory as FSELF's dont have to be debug, they can be retail. I used to modify eboots for CFW 3.55 (before deank's eboot mod) and one of the steps in the process was changing the retail eboot into an FSELF in the SCE header.
However in defense of the dev eboot theory, when I was playing Deus Ex i had weird things happen. My game would crash and my install data would go corrupt when i reinstalled the new install data would read DEV in the title. So being like someone else mentioned that it takes them so long that it might be harder than everyone thinks, I agree. But there's a possibility which i havent heard anyone mention is that they're using MORE THAN ONE METHOD to crack the eboots.
Also im kind of glad they're secretive about it by now if everyone had this knowledge of how they're doing it, that would mean Sony would have it too and thus put a stop to it. Being TB is releasing games that require current sony FW means sony doesnt know how they're doing it either or they do know but dont care enough because the info isn't available to everyone.