[LG G Pad X 8.0 Guides, News, & Discussion] joeblowma:
To use a modified boot image, such as a system image with root inserted while the device is locked requires the chain of trust to be intact - so that modified/rooted system image would need to be signed and we don't have those keys or any reasonable way of getting them. So no, there is currently no way to root without unlocking - though you can pretty much flash whatever you want it doesn't mean it will run. It's also not impossible to exploit things like the bootloader or files touched by the system but not in the system image - it's just rare especially when its a device that isn't widely adopted.

QFuses contain a lot of information, like model, serial, RSA keys... as well as some bytes set aside for anti-rollback. The fact that there is some set aside for anti-rollback does not necessarily mean they will be used - as I learned the hard way apparently devices with SIM cards distributed on the behalf of a carrier (ie: locked to a carrier)... it winds up being up to the carrier if/how/when these features and locks are implemented. T-Mobile's variant of this devices is V521, and they allow unlocking and thus probably will never have a reason to use the anti-rollback. Rogers/Fido here in Canada distribute V522 and have specified that the bootloader not be unlockable, thus if we ever find a bootloader exploit to get around this they may well patch that exploit and increment the anti-rollback value so flashing a vulnerable bootloader via downgrading will brick the device. There are also other variants of the same device, like V525 (korea/open) and a V520 (AT&T) with slightly different hardware (better front camera/bigger flash) and I'm not sure if those are locked out or not - but they are the same device at the core. For all intents though, after digging into the software sources, my V522 is identical to your V521 except for the model number and marketing name and possibly touch screen controller (the v521 seems to provision for possible additional chip variations.)

If you read my previous posts on the matter, I still fail to see why they don't want us to own our paid for devices, and I put that on LG for providing these "features", not for some slacker at Rogers/Fido for ticking the box to use them. This even affects updates for some reason - the previous update (10c on v521, 10b on v522) were built within 12h of each other but wasn't released to my device for nearly 2 weeks (presumably held up by Rogers/Fido and not LG). I'm still glad I have this device, if nothing else it's stretching the limits of what I know about android a bit - even if I despise LG for these locks :p

Its not so much a matter of finding it, as it is getting access to the right things to make it work. They do have to service these devices after sale (bricked device diagnosis/repair), and program the "blank" devices from manufacture (that have no bootloader at all) to the desired software/fuses/specs. I know after digging for info on LG devices in general some people are able to modify things such as IMEI and carrier with special tools most likely leaked from repair centers - the info is sketchy because these folks tend to do it for-profit.

You could well be right, and this bootloader just supports both syntax - one could always try "fastboot get var unlock" and "fastboot get var flashing" on an oem unlocked device to see if they come up with the same thing. If that is the case then it would mean those of you with unlocked bootloaders could probably flash recovery out of the gate - or that some sort of additional unlock key would be needed to allow it.