I recently purchased a Yealink T46S SIP phone from EBay as I wanted something with more line keys that supported Opus.
When it arrived it had an active account on it, which would potentially allow me to make outbound calls billed to the original owner. Unfortunately this is quite common for phones acquired on EBay and is incredibly poor practise.
The phone was quite well locked down with an admin password and the SIP signalling being sent via TLS, but a packet capture revealed the phone communicating with IPs belonging to Zoom.
Being an upstanding citizen I wanted to factory reset the phone so I could use it on my own service. The admin password prevented me from reseting the phone via the menu, but Google revealed that pressing the OK button for 5 seconds will factory reset the phone, or so I thought!
Instead, I tried setting the provisioning URL to http://127.0.0.1 (Settings > Auto Provision > Server URL) and removing the DHCP Option, however ZTP appears to take precedence over the Server URL and once again the phone provisioned onto Zooms service.
Tl;Dr: If your Yealink is locked to Zoom it appears the only way to remove it is by contacting Zoom, Yealink, or using a DHCP option to override ZTP.