I finally managed to install Mojave 10.14.1. As noted before, the High Sierra security update didn't work. (Tried several times.) So I went for Mojave 10.14.1 again. At that point I had already switched to Ethernet (using the HyperDrive SLIM 8-in-1), I had run `nvram -c` and `pmset -a restoredefaults` in Recovery Mode, I had disabled Safe Boot on the T2, I had disabled FileVault, had disabled all processes that might interfere like BlockBlock, Little Snitch, XFENCE, Firewall stealth mode, even Adguard. Nothing had worked. The Mojave 10.14.1 installation didn't work either. Whether High Sierra security update or Mojave 10.14.1, always the same thing: starts installing after logging out, then, after reaching 1 or 2 percent of the installation progress bar, quick reboot back into High Sierra.
The solution (at least for me) was to boot into Internet Recovery Mode (CMD-OPTION-r). Note: write down your WiFi password beforehand, or use Ethernet. It will then download the newest macOS installable on your Mac (which is Mojave 10.14.1), and then it installed just fine. I then ran into serious boot/login problems, namely the MacBook Pro freezing & crashing on the login screen, right after login, sometimes during boot. At first I thought it was a faulty installation, but the problem remained after installing Mojave again using Internet Recovery (even in safe boot mode with SHIFT pressed), so I booted into my High Sierra clone and removed all files and folders associated with the first of the assumed culprits, namely F-Secure XFENCE, incl. the kernel extension, and voila, it worked. I guess I had forgotten to set XFENCE to learning mode again, and instead had simply disabled it, and then it re-enables itself at next boot, which you really don't want during or after a system upgrade or update. So now everything's fine: re-enabled everything incl. FileVault, and it's back to normal. (Though dark mode 5uck5.)
But why didn't it install in the first place? XFENCE was always disabled at that point. I'm not 100% sure, but whenever I ran First Aid in DiskUtility on High Sierra, I received warnings that the system couldn't be cryptographically validated (three crypto_val errors). My hunch is that some of the 2018 MacBook Pro models were shipped/sold with a wrong build of macOS 10.13.6 (or bridgeOS). This in turn led macOS installers to abort installation, because they couldn't validate it either. This won't explain all the problems people have, but it might explain, why installation didn't work on my Mac all this time. (The crypto_val errors are now gone in Mojave; FileVault etc. working fine.)