Good news: I found what vita compares to his firmware version!!
Bad news: We cannot modify it without breaking the application
There are two numbers in eboot.bin at address 94/95. In 3.60 pkg installer them are 60 and 03 (this should make you think) and in 3.18 pkg installer them are 18 and 03. If you haven't found the solution it's very very simple. Address 94 is the second part of the fw version and 95 is the first one.
We can't modify it, else the application won't start.
But perhaps we can spoof our firmware to lower version (this sounds strange) and get pkg installer working once again on a cex vita!
I think we can modify something in the RAM