Yep, you can MITM the firmware update as the update itself is AES-GCM encrypted and signed… but I’ve no idea why it was taking so long on your router. Because the update is bigger than ram, it verifies it once then programs it the second time.
Note that no, you can’t insert an image that fails verification the second time. The imp won’t fall for it 
If you still have imps that won’t upgrade, a tcpdump of the connection would be really interesting to us. Wouldn’t have to be the whole process (as it appears to get stuck) but seeing the first couple of minutes would be most interesting.