The port behind IC is most easy, the diag port needs an unlock code from Tesla, so unless you have that it's useless to you.Thanks for the help!
Do I need the port behind the IC or I the 4-pin connector on the cable sufficient?
Are the firmware images checked for validity, or is it possible to brick the car with a corrupt file or a wrong version?
Are downgrades possible?
The firmware is checked for validity so you cannot just flash anything. There are no "wrong versions", firmware between all model X and S are 100% the same. Model3 is different, but I still don't think it'll let you to actually use that on an S and X.
They appear to be blocking downgrades (which is a sensible thing to do in a way).