I have some new information. Maybe there are different hardware revisions. I found a tear-down video of a T1000-E:
youtu.be/MyCKTc709Jw?feature=shared&t=269
The device in the video is revision 2.2 from 24/07/08, which has a GD25Q64EN 8MB QSPI flash chip. My board is revision 2.3 from 24/12/16, which has potentially only 4MB flash. Nevertheless, I wasn’t successful in connecting to the flash.