I’m running the risk of just getting an AI response back, but:

How are you able to boot Debian from an SD card, and without unlocking the bootloader?

Does the bootloader look for an OS on SD card by default? SD and eMMC are basically the same thing, is it just the same lines but an SD card takes priority over the eMMC? And does it not enforce verified boot properly / at all? Maybe being a Rockchip and not MTK/QCOM has something to do with it, but it’s still an Android device and I would assume there’s something in CTS/VTS/GMS licensing that makes verified boot mandatory.

Likewise, I don’t know if I’m getting a question from an AI or not :)

But the answer is fairly simple, on a lot of Rockchip devices I’ve used, if there is no SPI flash or custom boot order, the BootROM checks the SD card first and then falls back to eMMC.

That is what happens here. Take the tablet out of the box, write the image to an SD card, insert it, and it boots directly into Linux instead of Android.

So the eMMC Android bootloader can be locked, but it doesn’t matter much if the SoC boots from SD first. Verified boot applies to the Android boot chain on eMMC, not to an external boot path that is accepted earlier by the Rockchip boot flow.

And now you’ll never know if this was an AI answer or not :)