I'll second this. I just played around a little bit, and can confirm that the presence of build.mk in the app directory does cause it to be used. However, it seems to be a very sharp-edged feature, and I imagine if it isn't very well defined it could easily and silently break building.
In my case I used the following, inspired from ~/.particle/toolchains/deviceOS/1.4.4/firmware-1.4.4/main/src/build.mk:
build.mk
TARGET_MAIN_SRC_PATH = ./
CPPSRC += $(call target_files,$(TARGET_MAIN_SRC_PATH),*.cpp)
CSRC += $(call target_files,$(TARGET_MAIN_SRC_PATH),*.c)
(Please note that it's a verbatim copy except that I had to update TARGET_MAIN_SRC_PATH.)
While compiling, I could see that it was pulling in the CPP files, and the resulting binary file is identical. So success, maybe?
I have a concern about a customized build.mk file staying compatible with future Particle CLI upgrades. In my case, all I want to do is augment the compiler flags to use more warnings (Problems turning on -Werror), and nothing else. I worry that I will silently break things if I am, in addition to adding CFLAGS, accidentally overwriting critical Makefile variables.