Just received my TO1074 from Batronix. It came with the strap and all the options enabled except for 28M storage, including 500 uV and WLAN. It has a "delivery date" of 2016-12-22 and version 7.12.0.212. This version already has the option to record live videos, it creates AVI files encoded with H264 at 800x600 25fps at around 5500kbps. They look fine. The UI has some minor changes compared to mike's video, mainly the channel settings is a dialog now and has a few more options.
Unfortunately it doesn't seem to have telnet enabled. A TCP scan reveals ports 7, 13, 21, 37, 80, 8888, 18211, 18212. Port 8888 outputs large amounts of binary data constantly. It is what the remote control app uses (available on the chinese website, all it does is show the oscilloscope screen on the PC as it is on the device), so it is likely just a video stream. Port 18212 disconnects immediately without sending anything, port 18211 stays connected but also doesn't send anything. It is possible to login to the FTP with the root/micsig user, but it just shows the same files than via USB storage.
It is also possible to install options via a "licence" code, but it seems to be encrypted based on a device specific UID that it seems to get from /sys/devices/platform/cpu/uuid. So far I have not found any way of getting this UID, if it is not possible to obtain it easily the firmware upgrade route may be the only way to unlock it.
@cmpxchg let me know if you want me to test anything
.