I've found that QDLoader is activated in EDL mode (adb reboot edl; you will know you are in when the screen is off and nothing is happening) but I'm not sure how that's useful for us. fastboot and adb do not work in this mode. Volume down + Power button = FTM (field test mode) but I'm not sure what to do in that mode - you can use adb commands but you can't do anything special like mount system as r/w - no fastboot in this mode either. I also tried the ZTE Axon 7 tuliptool but that didn't detect anything (worth a try I guess). iRoot, srsroot, kingroot (pc & apk) don't root it in the FTM mode or regular OS. I've tried adb reboot disemmcwc thing to disable write protection but that didn't seem to do anything different. adb reboot bootloader only brings you to the regular OS. There is also a recovery, but that really only allows you to wipe data/cache and view logs, etc. (volume up + power).
There is an OEM Unlock option in the developer settings, but I still haven't found a way to get to use fastboot. Looking in the system, there are some debug scripts in the /system/bin folder, as well as busybox (toolbox & toybox included) which is interesting. The device is on 7.1.1 & security update "July 1, 2017" (any later exploits?). In "About", there is also a section called "Additional system updates" which seems to allow installing update packages from root directory on storage card?
I'm stuck there, as I'm not super knowledgeable in the art of rooting. Hopefully someone can figure this out!