I've done some work on the Z80 SBC and believe I've found a plausible explanation for the 0x1800 firmware offset. According to the manual, all Z80 memory accesses pass through the address mapping logic, which maps logical to virtual addresses with a 2K page size granularity. The mapping logic supports 8 maps of 32 pages, and generates address bits 19..11 as well as RESB (resident bus vs Multibus access), MEM/IO and WP (write protect) signals. My theory is that during reset (and probably during interrupts) the mapping hardware is disabled, and its outputs are forced or float high. This has the effect that Z80 memory accesses during these cycles have address bits 15..11 driven high, and the other signals indicate resident bus, memory, read-only accesses (i.e. on-board EPROM). When combined with the initial mapping established by the firmware indicating EPROM #0 is decoded at 0xe000 on the resident bus, the result is the Z80 fetching logical address 0 from physical 0xf800, which is offset 0x1800 in the firmware.

Based on an initial implementation, it's now trying to access the floppy disk drive, so that's promising.