I just started researching this today as I am looking to potentially buy some P1G6, have no schematic and no idea of what's inside but I'm tempted the test.
My humble opinion is that this not working has nothing to do with the eSPI itself basically by shorting the LPC or any bus at the time the bootloader tries to read the bios it makes it fail. this is actually patchable via software an I think if any laptop with an EC (even the ones that worked previously) has a updated FW it might not work.
This might need some serious reverse engineering, basically plug into the bus, listen and...

maybe add a 10K resistor on your short loop, that way you limit the current and less likely to damage anything....

Hi all!

Happy to join, I am an electronics engineer and i love tinkering with anything, found this forum on a journey to unlock a pwd protected bios