There's some bugs with the peelout in Sonic CD. There's certainly shenanigans to be had. (This does not apply to the remake, as that implemented it differently)

The 2013 remake of Sonic 2 directly ported the Death Egg Robot from the original game, but broke the way its arms launched at Sonic.

Unreferenced demo data exists for special stage 2 in the v0.51 prototype of Sonic CD. It never gets decompressed into the demo data buffer nor does the code to run it get called. However, with some hacking, it can be restored.

So, the 2013 remake of Sonic 2 made a change to the way the claw attack's hitbox works.

A technical dive (😉) into Sonic 3's water palette swapping!

Works perfectly now. Thank you!!

...the RV flag is also needed to access Mega CD Backup RAM cartridges.

Here's how the hardware manual explains ROM access and the RV flag. Also turns out the RV flag is needed for SSF2 bank switching.

This is what the memory map looks like.

I took a quick look at the firmware in IDA to see what this code was, and noticed this function that loads that code into address 0xA130A0, which is almost the same address in which the code is being exposed at, just off by 1 digit. So this definitely seems like a MEDpro issue.