The driver sends a specific USB control transfer (bRequest = 0x02). The BROM responds with its ID. The bypass tool injects a payload before the authentication timeout. None of this works without the driver properly enumerating the COM port first.
macOS has poor support. You can try HoRNDIS (deprecated) or use a Linux virtual machine with USB passthrough. Native BROM drivers for Mac do not reliably exist. mtk brom mode driver
However, researchers have found ways to bypass or downgrade BROM protections using (e.g., the famous "Amlogic USB Burn Mode" style issues). The driver remains the vector, but the payloads have evolved. The driver sends a specific USB control transfer