I’m running the risk of just getting an AI response back, but:

How are you able to boot Debian from an SD card, and without unlocking the bootloader?

Does the bootloader look for an OS on SD card by default? SD and eMMC are basically the same thing, is it just the same lines but an SD card takes priority over the eMMC? And does it not enforce verified boot properly / at all? Maybe being a Rockchip and not MTK/QCOM has something to do with it, but it’s still an Android device and I would assume there’s something in CTS/VTS/GMS licensing that makes verified boot mandatory.