It seems at some point, the 'locked' field in profile was not set and is null in the database, but subsequently became set to 0 by default.
However, a findSakaiPerson() call like this:
final SakaiPerson example = sakaiPersonManager.getPrototype();
final List<SakaiPerson> list = sakaiPersonManager.findSakaiPerson(example);
will fail to return records where locked is null, as the constructors used for getPrototype() set locked = 0.
A db conversion can fix this historical anomaly in profile records, viz.:
update SAKAI_PERSON_T SET LOCKED=0 WHERE locked is null;
but perhaps getPrototype() should also not check the locked value.
It seems the legacy Profile tool uses the value of locked to determine whether users may edit their profile or not.