Kamikaze hack on XBox, was sold as a template for drilling a bondwire on a SoC. This is without the tempalte: https://www.youtube.com/watch?v=1gCYXb54oig

This is insane. How do they even figure such things out? Is it by accident or careful research of schematics?

It's just accessing the onboard flash memory. Sometimes the easiest way in to a given pin is through the top of the CPU package (obviously they are not hitting any actual silicon), if all the traces are otherwise buried in the board.