This tablet was running an old Nougat LOS build.
I first flashed the latest official Samsung ROM to update firmware (T813XXS2BSJ3). I used heimdall (the Linux Odin variant) and flashed all the partitions available in the firmware zip.
I booted into stock (yuck), made sure everything was fine.
I went back to download mode and flashed the TWRP linked in the OP (which is not stock, it's 3.5.2_9-2).
Booted into TWRP.
Formatted /data, /system and /cache.
Sideloaded pitrus/wickenberg lineage-16.0-20210826.
Sideloaded OpenGapps 20210904 for arm64.
Cleared /cache and dalvik cache.
Rebooted into system, it hung as explained in OP.
Force rebooted, it went through and into setup.
Completed setup, went straight to Settings > Security > Encryption.
Setup pin, encrypted device, that failed because of https://gitlab.com/LineageOS/issues/android/-/issues/1027
Rebooted into recovery, shrunk userdata by 4 blocks (16 kiB) as described in the link.
Rebooted into system.
Went back to encryption and started the encryption process. That worked.
Then I flashed Magisk using the patch boot image method.
The old tablet is working fine, I even have a large adopted storage SD attached to it.
The only issue is that the encryption password is reset to default every now and then, couldn't find a pattern as to when it happens. That's quite annoying as encryption is now defeated.