> Re-locking the bootloader does make the camera work again, which indicates that it’s more of a software-level obstacle

My guess is that their camera supplier has a secret blob that they want to retain encrypted...