It depends on the definition of locked.. I can clarify the boot process, then you can make your own conclusion
the boot process is a multi stage process:
on power on, the CPU0 runs the very first bootloader from ROM memory, called 'primary bootloader' or PBL. it is closed and 'hard coded' on the SoC
the PBL will load the Secondary BootLoader (or SBL) from eMMC or SD card. the SBL will run from internal memory and its job is among many things to : initialize the DDR, load the trusted firmware (TZ) and load the RPM firmware (on the RPM core in charge of 'power management'). The SBL is closed source and provided as 'binary blob' on Qualcomm website.
the SBL will in turn load the Application Bootloader (APPSBL or aboot) from SD or eMMC. This bootloader currently is LK and it is open source. There are instructions to get the source code and rebuild LK in each release notes.
LK will load the kernel image and optionally the initrd, and then we are in 'linux hands'.
On 'real' product such as phones and tablets, PBL, SBL and APPSBL requires authentication and can only load signed images, so you cannot replace or rebuild LK or kernel if you can't sign them. However for DragonBoard 410c the only the PBL authenticate SBL, but the SBL can load un-authenticated APPSBL , so that developers can rebuild and/or customize APPSBL.