I think the potential for abuse is high. With a locking system, someone could (and probably would) click (manually or with a script) on a time slot to "reserve" a room just in case they needed it.

These are physical meeting rooms within a company. The resolution to this sort of abuse doesn't need to be automated, first it's a person in the facilities team having a quiet chat with the person doing that and asking them not to, eventually it gets escalated through various managers until it's a very final chat with HR before being asked to leave the building and not come back.

And if they did it a lot, they're scolded or fired.

That's not a real problem - at least not in the "book a corporate meeting room" space.

Clearly you fell for the premature measuring fallacy, everyone knows to optimize for web-scale first.