I stumbled on this restriction again, and dug a bit deeper in the issue.
It appears that the hardware is not limiting the baudrate, but the M5Stack library. More specifically, M5.begin();
Luckily, you can skip the UART init, and do it yourself like this:
And now it works for 2000000 baud.