It seems lk doesn't need hacked. I found this in /vendor/bin/write_protect:
echo -n "DISABLE_POWP" | dd of=/dev/block/platform/bootdevice/by-name/oembin seek=30720 bs=1 conv=notrunc
I was just waiting on super to flash (I broke it) and looking in vendor.img for "prot" to see about network unlock stuff and there it was.
EDIT: Tested and working. I'm removing my modified lk since this is better.