I know I can call a suitelet from a beforeSubmit by making a suitelet "available without login". Unfortunately, that suitelet lies in a locked bundle and now I'm wondering if anyone has found a way to call a suitelet that require's login?

In a locked bundle, script records cannot be edited, but deployments can. You set the “available without login” checkbox at the deployment level, so you should still be able to call it in this fashion.