You can lock the bootloader after the first boot, it’s just a lot riskier and I would always advise against.
If everything is as it should be, meaning the security patch level of the factory images you are flashing matches / is higher than the current ones and the keys those images are signed with are the ones the system expects, get_unlock_ability doesn’t concern you at all.
But for your example where you installed old factory images, that would have been a brick 
I won’t repeat my rant(s) here because I’ve said it all before, bottom line is all of this could be handled better by Fairphone and it just isn’t, for whatever reason 