If yur cfe.bin file has NVRAM starting at 0x680 it means your cfe.bin file includes headers and is not headerless, strip them away in order to flash it via JTAG. This has been tested on a device running up to B079 OEN firmware version, using OpenOCD 0.12.0 and a TUMPA JTAG adapter at 20000KHz.
Now I have these files waiting to be flashed: openwrt-ipq807x-generic-xiaomi_ax3600-squashfs-nand-factory.ubi; openwrt-ipq807x-generic-xiaomi_ax3600-squashfs-nand-sysupgrade.bin; All I changed with menuconfig is the target and device. Is that all or are there other important settings to take full advantage of the hardware? It's probably copying files after mounting the squashfs which are files or directories that need editing. Example some files in /usr or /var will be copied over to ram during the boot process, unless the liveCD implemented an overlay filesystem like auFS or overlayfs with the former being used in the Gentoo Linux liveCD which doesn't required copying directories from its squashfs image.