The current Bootloader component implementation expects the data to be as per the Bootloading protocol. There must not be extra bytes. Also the commands must be send only when the SPI slave is active.
May be you can use another Pin from slave which will interrupt the master and master can start sending data. SPI protocol is Master oriented so only Master can have control.
Well, that doesn't fit very well with SPI to be honest. It's interesting this I can't see that this is mentioned in AN84401 (PSoC® 3 and PSoC 5LP SPI Bootloader)..?
The extra pin would require extra code on the PSoC side.
Yes you will need to add extra code in the bootloader as well as host code.