Here it is, another introduction article about primary and secondary bootloaders using Cortex-M as the target processors. There are many articles online about this topic. But it is still difficult for a starter to understand the concept. Taking below app note
AN10866 LPC1700 secondary USB bootloader
as an example. Many discussions referenced it. It talks about primary bootloader calling the secondar bootloader and shows below memory mapping. But where is primary bootloader? Why 2nd bootloader resides in address 0x0? In this case, 2nd bootloader runs when system is out of power cycle and starts to boot.
Some more questions if you think you understand how bootloader and boot works. You heard about interrupt vector table remap using VTOR of Cortex-M. But what about memory mapping remap which is much less mentioned but could play an important role in boot process?
Use points to gain access. You can either purchase points or contribute content and use contribution points to gain access.

Good introduction.
I heard instead of using gpio, bootloader can read external eeprom or flash to figure out if need to download from them?
Yes some bootloaders use this approach. But here is a caveat. Embedded SOC is normally pad limited. Pad may be connected in a different way on different platforms. Pads connected to eeprom or flash mem could be used for other purposes. Blindly read external mem may cause issue. A safe way is to use a GPIO to know whether external mem is available.