[Thinkpad Tablet General] wonderfulme:
There was indeed an option for "OEM unlock" in dev settings which I somehow missed. Works as intended now.

So here's the output of fastboot:

F:\AndroidSDK\platform-tools>fastboot oem device-info
...
(bootloader) Device tampered: false
(bootloader) Device unlocked: false
(bootloader) Device critical unlocked: false
(bootloader) Charger screen enabled: false
(bootloader) Display panel:
OKAY [ 0.054s]
finished. total time: 0.054s

Guess we're out of luck here?

I also did an "adb shell" and /proc/partitions as well as /system/build.prop are readable, "mount" works, however I have no idea where the kernel is stored. There's a "/firmware" dir but it's unaccessible, I'm thinking maybe that's where:

2|TB-8704X:/ $ uname -a
Linux localhost 3.18.31-perf-g40dd5c6-dirty #1 SMP PREEMPT Fri Jul 7 02:02:41 CST 2017 aarch64
TB-8704X:/ $ id
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc) context=u:r:shell:s0
TB-8704X:/ $ ls -ld firmware
dr-xr-x--- 4 system system 16384 1970-01-01 03:00 firmware
TB-8704X:/ $ cd firmware
/system/bin/sh: cd: /firmware: Permission denied

Also, FWIW, here's a list of files/dirs in / in case I missed something of note. I'm not really comfortable with Android internals.

130|TB-8704X:/ $ ls -l
total 4232
dr-xr-xr-x 61 root root 0 1970-03-08 03:34 acct
drwxr-xr-x 2 root root 40 1970-01-01 03:00 bt_firmware
drwxrwx--- 7 system cache 4096 2017-08-10 16:42 cache
lrwxrwxrwx 1 root root 13 1970-01-01 03:00 charger -> /sbin/healthd
drwxr-xr-x 2 root root 0 1970-03-08 03:34 config
lrwxrwxrwx 1 root root 17 1970-01-01 03:00 d -> /sys/kernel/debug
drwxrwx--x 43 system system 4096 1970-03-08 03:34 data
-rw-r--r-- 1 root root 995 1970-01-01 03:00 default.prop
drwxr-xr-x 15 root root 3500 1970-03-08 03:34 dev
drwxr-xr-x 3 root root 4096 1970-01-01 03:00 dsp
lrwxrwxrwx 1 root root 11 1970-01-01 03:00 etc -> /system/etc
-rw-r--r-- 1 root root 186677 1970-01-01 03:00 file_contexts.bin
dr-xr-x--- 4 system system 16384 1970-01-01 03:00 firmware
-rw-r----- 1 root root 1578 1970-01-01 03:00 fstab.qcom
-rwxr-x--- 1 root root 1246704 1970-01-01 03:00 init
-rwxr-x--- 1 root root 1846 1970-01-01 03:00 init.carrier.rc
-rwxr-x--- 1 root root 3295 1970-01-01 03:00 init.class_main.sh
-rwxr-x--- 1 root root 1156 1970-01-01 03:00 init.environ.rc
-rwxr-x--- 1 root root 1730 1970-01-01 03:00 init.mdm.sh
-rwxr-x--- 1 root root 29161 1970-01-01 03:00 init.msm.usb.configfs.rc
-rwxr-x--- 1 root root 7054 1970-01-01 03:00 init.qcom.class_core.sh
-rwxr-x--- 1 root root 12035 1970-01-01 03:00 init.qcom.early_boot.sh
-rwxr-x--- 1 root root 3775 1970-01-01 03:00 init.qcom.factory.rc
-rwxr-x--- 1 root root 37960 1970-01-01 03:00 init.qcom.rc
-rwxr-x--- 1 root root 2029 1970-01-01 03:00 init.qcom.sensors.sh
-rwxr-x--- 1 root root 12173 1970-01-01 03:00 init.qcom.sh
-rwxr-x--- 1 root root 2962 1970-01-01 03:00 init.qcom.syspart_fixup.sh
-rwxr-x--- 1 root root 97623 1970-01-01 03:00 init.qcom.usb.rc
-rwxr-x--- 1 root root 10950 1970-01-01 03:00 init.qcom.usb.sh
-rwxr-x--- 1 root root 26676 1970-01-01 03:00 init.rc
-rwxr-x--- 1 root root 9584 1970-01-01 03:00 init.target.rc
-rwxr-x--- 1 root root 12058 1970-01-01 03:00 init.usb.configfs.rc
-rwxr-x--- 1 root root 5715 1970-01-01 03:00 init.usb.rc
-rwxr-x--- 1 root root 411 1970-01-01 03:00 init.zygote32.rc
-rwxr-x--- 1 root root 684 1970-01-01 03:00 init.zygote64_32.rc
drwxr-xr-x 10 root system 220 1970-03-08 03:34 mnt
drwxr-xr-x 2 root root 40 1970-01-01 03:00 oem
drwxrwx--x 13 root system 4096 1970-01-01 03:00 persist
dr-xr-xr-x 518 root root 0 1970-01-01 03:00 proc
-rw-r--r-- 1 root root 11549 1970-01-01 03:00 property_contexts
drwxr-xr-x 3 root root 60 1970-01-01 03:00 res
drwx------ 2 root root 40 2017-07-06 21:00 root
drwxr-x--- 2 root root 160 1970-01-01 03:00 sbin
lrwxrwxrwx 1 root root 21 1970-01-01 03:00 sdcard -> /storage/self/primary
-rw-r--r-- 1 root root 1957 1970-01-01 03:00 seapp_contexts
-rw-r--r-- 1 root root 90 1970-01-01 03:00 selinux_version
-rw-r--r-- 1 root root 285602 1970-01-01 03:00 sepolicy
-rw-r--r-- 1 root root 17999 1970-01-01 03:00 service_contexts
drwxr-xr-x 4 root root 80 2017-08-12 15:57 storage
dr-xr-xr-x 16 root root 0 1970-03-08 03:34 sys
drwxr-xr-x 21 root root 4096 1970-01-01 03:00 system
lrwxrwxrwx 1 root root 16 1970-03-08 03:34 tombstones -> /data/tombstones
-rw-r--r-- 1 root root 14131 1970-01-01 03:00 ueventd.qcom.rc
-rw-r--r-- 1 root root 4857 1970-01-01 03:00 ueventd.rc
lrwxrwxrwx 1 root root 14 1970-01-01 03:00 vendor -> /system/vendor
-rw-r--r-- 1 root root 524 1970-01-01 03:00 verity_key

So are we out of options yet unless a new Linux kernel exploit eventually comes along OR Lenovo decides to release the firmware? I don't believe dirtycow would work here, considering July 2017 security updates have been applied.