Ah yeah, you gotta check bootloader lock status before buying. That's something that frosts me too, and it's why I pretty much only buy from OnePlus or Google.

If you buy a hack-friendly phone though, I've found it to be fairly easy to do, although I've always used CLI tools, so if someone (like non-techy friends) were to do it they'd probably be put off by the CLI.