So you inspired me to look into how this serial programming stuff works, it all seemed just a bit too flexible to be true. As I mentioned before I’ve only ever used the SWD interface for flashing, so I’ve not tried any of this and it’s based solely on some quick research this morning.
I came across AN2606. Section 6 seems to be the relevant one for your device. The good news is it does indeed poll multiple UARTs for an incoming 0x7f and then uses that UART. The bad news is, it requires the UARTs to be mapped to known pins (PA9 and PA10 for UART1 and PA14 and PA15 for UART2).
In your experiment here, you used PA9 and PA10 (UART1). Are you sure when you tried UART2 you used PB3 and PB4, and not PA14 and PA15?
The schematic has the FTDI programmer header connected to PB3 and PB4. Once your f/w is up and running it can easily map those pins to UART2, but until then I think the bootloader will have UART2 mappped to PA14 and PA15 (at least according to AN2606).