Even with unlockable bootloaders, you're still never completely getting rid of what I call predatory code signing. The code you're able to run on an Android phone after unlocking the bootloader runs with EL1 — the privilege level sufficient for an OS kernel. Problem is, there are higher privilege levels aka ARM TrustZone (I think they go up to EL3?), and you're never getting access to those. And there's a "secure OS" that runs in those, and that, among other things, manages DRM and SafetyNet.