Forgot to mention before: I have two T408DLs, one 8GB, one 16GB. Used images from [Login to see the link] (neutron.img for boot, recovery2.img for recovery). On the 16GB, first neutron.img gave Magisk root, so I could backup the original recovery via dd before flashing the new one. On the 8GB, first recovery2.img gave adb shell with su, backed up original boot with dd before flashing new one. Now have backup original boot and recovery. (There might be a better way to do it.)
(Recovery2 is a good back door in case any mods goes south.)