I'm not sure if anyone replied to this question...
When the high memory HID bootloader is flashed to the MCU, one part is installed in the base of Flash and the main body of the bootloader is at the top of flash.
The part of the bootloader that is in the base of Flash is only the vector table (only things like the Stack Pointer and Reset Vector etc, probably some of the ISR's needed for USB and possibly for systick etc)
When the MCU boots it always reads the base of Flash to get the SP and the start address of the application code.
So the execution then runs the main body of the bootloader which is in the top of flash
The trick is... When a normal application binary is uploaded to the high memory HID bootloader, it overwrites the SP and start vectors, with its own SP and start vector.
But if you upload the same binary via Serial UART or ST-Link the SP etc vectors won't get updated, so the high memory bootloader will be orphaned, as it will never get run again