[Moto G Power Questions & Answers] ScienceStoleYourPrivacy:
So Motorola Support Centre have been in touch and stated:

I am really sorry to say that the kill switch feature, which is known as "Google Lock" is not bypassable by anyone other than the repair center.

So they are stating the Android Factory Reset Protection (FRP) can be bypassed which is another way of saying it can be undone, so the next challenge is finding out where on the device this flag or flags resides.

Is it something like the RaspberryPi One Time Programmable (OTP) switch's that may not be One Time Programmable but like the dip switches seen on the motherboards of early 8086/286/386/etc personal computers, or something else like a file on the main storage device with the rest of android.

I think the first thing to do is get Wireshark and the USB sniffer to see what information is being sent over the USB cable.

And as its possible to get the device online via wifi, it's probably a good idea to see what information is being sent over wifi, so using wireshark on a raspberrypi masquerading as an access point might be useful as well.

So the first thing to do is have a look at the Android documents

Android

Android has 127 repositories available. Follow their code on GitHub.

github.com

https://developer.android.com/reference/android/app/admin/FactoryResetProtectionPolicy

The factory reset protection policy determines which accounts can unlock a device that has gone through untrusted factory reset.

So it looks like Android are also stating the Factory Reset Protection can be undone. It seems a that a single user setup and a corporate setup exist, where a corporate account could be used to remotely wipe a device and then reenable the device, I guess if the user hands it back to the company.

https://developer.android.com/about/versions/marshmallow/android-6.0-changes API 23

EXTRA_PROVISIONING_RESET_PROTECTION_PARAMETERS is removed so NFC bump provisioning cannot programmatically unlock a factory reset protected device.

You can now use the EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE extra to pass data to the device owner app during NFC provisioning of the managed device.

Interestingly, NFC can be used to unlock FRP in earlier versions of Android. and its possible to use NFC to potentially configure and more other devices using NFC. As NFC is just a low power and thus low range frequency in the RFID range of frequencies alot of other things could be possible. NFC to me is just like any other form of communication method, beit a usb cable, telephone wire, wifi, ultrasonic sounds, or Infrared.

Radio-frequency identification - Wikipedia

en.wikipedia.org

NFCIP-1 and NFCIP-2

Near-field communication - Wikipedia

en.wikipedia.org

As NFC can communicate a request and response, and Android is using NFC to configure devices, using NFC may be a novel attack vector for peoples android devices, without them knowing about it unless they capture on a personal webcam everyone and every NFC device they come in to close contact with. Maybe using payment terminals could become a new attack vector at your favorite local retail outlet?

Well if Covid doesnt make people socially distanced, then maybe an NFC attack vector might if it works beyond the claimed 4cm operating range! Unfortunately this phone does not come with NFC, but others do.

I've got to find the source code....

Android (operating system) - Wikipedia

en.wikipedia.org

Most versions of Android are proprietary. The core components are taken from the Android Open Source Project (AOSP), which is free and open-source software (FOSS) primarily licensed under the Apache License.

Search results for "factory reset protection" | Android Open Source Project

source.android.com

The default implementation of Test Harness Mode uses the same storage mechanism as Factory Reset Protection to store the ADB keys temporarily in a persistent partition.

So it looks like I need to gain access to this "persistent partition" and try to find this ADB for starters.

Seems a bit sneeky of Google and Android here. https://source.android.com/docs/security/bulletin/2016-02-01

At the bottom of the Android webpage is a link to Factory Images of the Google Nexus and Pixel phones which jumps you to Google web page. No indication what so ever I'm leaving Android and going to Google!

Flash with Fastboot | Android Open Source Project

source.android.com

To enable OEM unlocking on the device:

In Settings, tap About phone, then tap Build number seven times.

When you see the message You are now a developer!, tap the back button.

In Settings, tap System, then tap Developer options and enable OEM unlocking and USB debugging. (If OEM unlocking is disabled, connect to the internet so the device can check in at least once. If it remains disabled, your device might be SIM locked by your carrier and the bootloader can't be unlocked.)

Reboot into the bootloader and use fastboot to unlock it.

For newer devices (2015 and higher):

fastboot flashing unlock

For older devices (2014 and lower):

fastboot oem unlock

Tip: if you're seeing `adb devices` output before reboot but fastboot or the flash script are misbehaving, it might be issues with your USB cable. Try a different port and/or switching connectors. If you are using a USB C port on your computer try a USB A port instead.

Confirm the unlock onscreen.

Well the instructions I've seen only talk about the gaining access to settings and the doing 7 taps on the Build Number. Lets see if the rest of the instructions work.

Onwards and upwards....