It doesn't protect against root exploits, but it protects against data dumping with physical access. Hence why unlocking the bootloader forces a data wipe. It does not hurt users at all if there's an unlock, which all of Google's devices have.