Finally I was able to make the bootable firmware. I'm was able to add one executable that is needed for me (aprox 56k in size) and have modified the boot sequence to launch the init file from the usb drive if one found (/mnt/usbfs/init).
So for now my wl500g launches telnetd at startup and alters the firewall settings to drop requests to telnet from the outside.
So it's possible, but I still can't inject telnetd to the rootfs - maybe just a size or the align issue...