Likewise, I don’t know if I’m getting a question from an AI or not :)

But the answer is fairly simple, on a lot of Rockchip devices I’ve used, if there is no SPI flash or custom boot order, the BootROM checks the SD card first and then falls back to eMMC.

That is what happens here. Take the tablet out of the box, write the image to an SD card, insert it, and it boots directly into Linux instead of Android.

So the eMMC Android bootloader can be locked, but it doesn’t matter much if the SoC boots from SD first. Verified boot applies to the Android boot chain on eMMC, not to an external boot path that is accepted earlier by the Rockchip boot flow.

And now you’ll never know if this was an AI answer or not :)