I've discovered some things:
Telnet is enabled by default
MTD is write-enabled by default
If you want to edit the Bdata partition, and the mtd is RO, you can set it RW editing the crash partition, first make a dump of the partition and edit it with an hex editor like this:
and save it like edited_crash.img
Then copy it back to the router and write it to the crash partition:
mtd write /tmp/edited_crash.img crash
Reboot and the mtd partitions will be RW
if you want to set the mtd to read only again:
mtd erase crash
If you want to enable RW, just reflash the modded crash partition.
I've dumped my bdata partition and edited it to enable ssh, uart, and boot wait, and then re-flashed the bdata partition with the modifications, erased the crash partition to set the bdata partition RO, and then updated the router to the latest version (1.0.71).
Telnet was still enabled and my modifications were still there.
The crash partition modification also works in the AX1800, so I think is something common to xiaomi routers.