This has to be done on the motherboard, where it doubles as the character font generator.
Note that pin 1 is on a wide 5V track, and fiddly to isolate. I've just put my code in both halves of the 28C256.
As mentioned elsewhere, the G007 board 'patches' the ZX81 BASIC to change the syntax of graphics commands.
I suspect this could be done more easily by having a ROM with two copies of BASIC, one as normal and one pre-modified. The patching logic could then be removed. However, this would have two problems back in 1982.
Firstly, much of the new ROM would be Sinclair code, and thus open to litigation.
Secondly, memory was more expensive back then. In December 1983 when the Maplin article was published, UK prices in Electronics Today International February 1983 were:
2716 £2.79 (£11.73)
2732 £2.99 (£12.57)
2764 £9.99 (£41.99)
(2023 equivalent price in brackets)
I can't even seen a 27128 or 27256 in that issue, but even if the price was directly proportional to size,
then 20 or 40 pounds then would be the equivalent of 84 or 168 pounds in 2023.
In 2023, one can now buy a 32K EEPROM for about £11, equivalent to the price of a 2716 in 1983.
So price isn't an issue and Sinclair no longer exists.
It also occured to me that the code in the 'shoulders of giants' version may be so different from the original that the ROM patching does not match, and thus fails.
So I decided to get the latest official ZX81 ROM (version 3) and compare the patched areas with the original. I found out I had done this way back in 2011-05-02.
Only 17 bytes are modified in the RAM patches. There are some differences at 07FD, 083E and 0843 which I wasn't expecting. I thought the ROM patch was at 0C00 and 2C00. Maybe the emulator used a very different board? This will need checking out.
I've uploaded the files I have created so far.