If someone gets a physical access to your device - you are already in a serious trouble. It's too late - the device is compromised and no locked bootloader will prevent nasty things. Same goes about desktop computers too. So this is hardly justifiable and always looks more like power grab than any real security reasons. In Jolla's case it's highly surprising. Having an open enough device was expected. Surely if some encryption is used it should be explicitly controlled by the user who sets it up (setting your own keys etc.). Otherwise this is completely not true:

https://sailfishos.org/wiki/QA