One simple request to solve my concern. Can we have a lock to installing / unistalling applications (password protect).
Short answer: No.
Long answer: Not really. While the application manager or fapman etc could be written to require lock codes of some kind (though on HAM's part this would require Nokia to do so, which they won't) these application managers are still just frontends for apt, which someone stealing the phone could just use directly to remove the package. Or, bypassing apt entirely, the application could be removed directly using dpkg. Or, the application's binaries could just be manually deleted. Etc etc etc.
as said, you only can make things harder. mounting rootfs to read only(might mess things up completely), removing/renaming apt, su, etc binaries, modifying HAM menu shortcut to point to /dev/null etc etc etc
but how hard is it to get the IMEI by opening the back cover, go to tablets-dev.nokia.com, download the FW + eMMC images and do