When configured properly, xsecurelock does fix this type of bug. The key is to use the -l option of xss-lock, which passes a lock file descriptor to xsecurelock and waits for it to be closed before allowing the suspend.

https://github.com/google/xsecurelock#automatic-locking