I have noticed that SM-T290/5 devices, while it definitely supports bootloader unlocking (it has OEM unlocking, and even shows bootloader unlock when you enter Download Mode!), it does not care about the bootloader unlock and attempts to verify all images present on the device. In such a case, it would fail with `SECURE CHECK FAIL: recovery.img`, or boot.img, or any others.
Even with disabling all checks in vbmeta, the bootloader does not care and keeps running whatever signature check it is doing. This should not be happening on unlocked bootloaders, and is not limited to just my work; you cannot boot a custom recovery, install root, or anything else.
The only reason I, and my users, were able to get anything custom on this tablet up until this point was due to the fact that SM-T290 was still on bootloader SW REV 3, and thus we were able to downgrade to the only bootloader version that can load any custom images, which is T290XXS3ATF1. This has many downsides:
Samsung has since raised SM-T290 to bootloader SW REV 5, and SM-T295 to SW REV 6, so downgrades no longer work
There appears to be a certain revision of these tablets that shipped with Android 10 from the factory, and those would cause a black screen when trying to boot the ancient bootloader that works
I would like to contact someone at Samsung developers to resolve this, as this device clearly seems to intend to allow bootloader unlocking, and yet the bootloader's verification system is so broken it doesn't even disable when it should be. Where could I get started on that?
