Along with the other excellent answers, both boards and chips may be designed general purpose, but often components are disabled in hardware or are unpopulated. Sometimes, a jumper needs to be applied, a trace re-routed, or a JTAG command sent to activate debug mode which allows physical access to parts of a board/chip that are gated by the JTAG controller.

So your best friends here beyond fuzzing and probing are searching for similar schematics, painstakingly testing all I/O with an oscilloscope, and taking an electron microscope to things to see what’s physically there.

Sometimes though, it’s as simple as thinking like the engineers who designed the component in the first place and asking yourself “If I were designing this, what shortcuts would I take, what would I want to debug / put in a test suite, and what would I make general purpose in order to cut costs on component placement and board reuse.