In the case of a consistent bundle that is expected to handle situations clients throw at it without modification on their end yes, locking makes sense. Anything specific to the client account shouldn't be bundled and locked, and you should manage that with a code repository so that the code can be quickly compared from your system to the clients in the event of difficulties. Especially - don't lock stuff you pushed from your own sandbox to prod. It'll get locked and stay locked forever.