I've investigated several dumps and not yet found a way to extract the FirmwareFeatures or FirmwareFeaturesMask from the dump of the BootROM image, while I can get AAPL,PathProperties0000 from all dumps I've looked.
Usually the only entry with GUID 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14 present is AAPL,PathProperties0000.
I'm clearly missing something.
Edit:
I'm not missing it, it's really not an entry stored inside the NVRAM volume, I've scanned hundreds of dumps for the full GUID and also the FirmwareFeatures value itself with base64, little-endian, big-endian. It's is stored, probably generated, elsewhere. I even read the efi.h to try to understand where this could be generated, but no clues yet.