The flash ROM WDC have used is software programmable. According to the data sheet they are using two pins to control the top address bits A<17:16>.
Quote:
1 x 128Kbytes FLASH ROM (32PLCC Socket) mapped as upper 32KB of Memory Map with
overlays off of 2 IO pins from the W65C265S (P43 = FA15; P44 = FAMS).
On the 816SXB there are external pull ups resistors to make A<17:16> = %11 on start up you board is probably the same. Change the pins to low outputs to select the other banks. In my code I make the pin an input to return it to high.
The unlock sequence is documented in the flash ROM's data sheet. It consists of a sequence of writes of specific values at specific offsets from the base address of the ROM.
Make sure you get a copy of ROM before trying to write to it - just in case. The debugger has a memory export feature. I'd recommend test writing to a area where WDC don't have any code in their bank to start just in case it screws up.
Alternatively buy a spare flash ROM and a PLCC32 adaptor for use with an EEPROM programmer or build a circuit with another microcontroller to download code into it (e.g. PIC or AVR with USB Serial and a socket to hold the ROM). There were a couple of projects on here a year or so ago to build such circuits for DIP flash ROMS.
I have been working on a tool to download into my 816SXB but its not working yet - There's a bug in the XMODEM routine and I haven't had time to work on it. The code is here:
https://github.com/andrew-jacobs/w65c816sxb-hacker