Is there actually any evidence that the bootloader is locked? Keep in mind there's a difference between a locked bootloader and a bootloader that doesn't support flashing by default.
A truly locked bootloader (like HBOOT on HTC devices or Motorola's MBM bootloader) actually verifies a digital signature on the boot or recovery partition before booting it, so it's not possible to run custom ROMs without using workarounds like 2nd init.
On the other hand, some bootloaders don't allow you to *flash* images by default, but if you manage to get root and flash a new recovery or boot image, it will boot without complaint.
Unless someone has a reason to believe otherwise, it might be possible that the Sony Tablet S falls into the second category. Now that root has been achieved, it's possible to flash custom recovery images by writing to a block device using ADB.
It's definitely worth trying this out. Someone who knows what they're doing should create a full backup of the original recovery partition (using "dd" from a root shell) and flash a custom recovery image to the appropriate block device and see what happens when you try to boot into recovery mode. There's a chance it "just works".