It has been confirmed to me by Espressif people and others that this AWS ExpressLink version of the module is indeed locked and cannot be (totally) erased. It can be updated only with signed firmware from the same ecosystem.
Consider this item closed.

I have this module designed into a product for general WiFi use. Unfortunately procurement department 'accidentally' bought the ESP32-C3-MINI-1-N4 -A module which is preconfigured with AWS ExpressLink firmware. It appears to be 'locked' with secure-boot-v2 and the bootup-download port is disabled. I...