I found a way to flash openwrt without unlocking uboot. You have to open the device and short 2 pins on the flash memory chip at the right time. Chip select and data out. On my a60 it's pins 7-8 but check the data sheet for the memory chip to be sure.
Use the serial port to watch the boot messages.115200 8n1
Pinout J1 vcc(1),gnd(2),txd(3),rxd(4)
Use the ap51-flash method with openwrt firmware.
When the router tries to download fwupgrade.cfg.sig momentarily short the pins and if you get the timing right it will then download the kernel, roofs and write them to flash. Then it will boot up openwrt and will cold boot just fine.
If looking at the chip with the dot marking on the lower left corner, the 2 pins you'll need are the 2 in the lower right corner.
You have to short the pins pretty much right before the fwupgrade.cfg file is requested, which is before you'll have any real output from ap51-flash to notify you that the device was found. You may get better timing notifications by using the serial port pinout, but I did not.
Let the device boot a few times and time how long after boot the fwupgrade.cfg request appears in ap51-flash, and then try to short the pins just before that time. This should then skip the next request for fwupgrade.cfg.sig and then continue to request the other firmware files.
For anyone wondering, you will need to remove a total of 7 screws. 4 are underneath the small round rubber inserts that are immediately visible: 2 are in the inset portion of the device, next to the removable hatch, and 2 are in the small oval insets on the side. The other 3 screws are underneath the small adhesive oval rubber inserts along the top edge of the device, which then have round inserts below them.
Just wanted to mention this also worked for me on an A60. Not too bad a task with chip pin probes. Attached a switch on a breadboard to make timing easier and because the probes kept coming unclipped otherwise. I didn't trust myself to not accidentally short other pins if I was using a screwdriver or something instead.
It seemed like I had to short only about 2 seconds after applying power, otherwise it would be too late.
