It seems to act like an IOS; it boots some unknown 1-2 Broadway code that installs WADs from an SD card; this probably also lives externally, either on SD or through the Gekko ports, since it has been updated at least once, despite there only being one boot2v0 version. Older versions of this 1-2 title write the WAD footer to /meta, which reveals that the IOSes installed by the Broadway code are not the normal ones, but instead special factory ones called "SD OS" or "SD IOS."
It is also possible that this was one of the original development versions of IOS; it makes sense for testing purposes that a Broadway binary would be loaded from the outside, since installing test binaries to the NAND would be complicated. This would also explain the "Format" IOCTL in /dev/fs, since that would not cause a brick if IOS was loaded from the boot stages. It should be noted that IOS itself seems to have originally been the same as boot1, seen in the Starlet patent (where IOS is referred to as "Secure Kernel" and ES/IOSC is referred to as "Security Functions").
ES_GetTitles used to be called ES_ListTitlesOnCard, seen in an SEL file. This is the only Starlet binary known to load code from some form of "card" as opposed to the NAND, so it is likely that boot2v0 has no knowledge of the NAND itself. Titles are most likely installed by the 1-2 code by requesting IOS3 from the SD card in the TMD, then reloading to an IOS4 that has NAND support.