Ok some people need some education here, so here goes.
The ATT S4 Bootloader was technically LOCKED when it shipped. There was however a bootloader exploit that allowed custom roms and recoveries, this exploit was known as LOKI. Loki is not a true bootloader unlock, it is a bypass. It intercepts instructions during the boot process that allows unsigned code to be run. This exploit was patched in later updates by Samsung, and all current Samsung's are no longer vulnerable to the LOKI exploit.
The S5 on tmobile is BOOTLOADER UNLOCKED. This is confirmed. To those saying TMO is locked you are mistaken. I will enlighten you as to why. The root method used to obtain root on the TMO S5 requires an Unlocked BL to be successful. CF Auto Root by Chainfire works by modifying the stock recovery partition and then using ODIN to flash the TAR file. Odin flashes this modified stock recovery which then pushes SU binary which then flashes the Stock S5 firmware over. This only works if the BL is unlocked. 1 of 3 outcomes will happen if trying to flash on a locked BL. First if the BL is locked Odin will error out saying that the modified recovery image is not official/signed (end of story thats it), this is the most likely scenario. If somehow the modified image flashes onto a locked BL, the phone will not boot. Worst case scenario it flashes and you end up with a brick.
CF has already stated his root method won't work on the ATT S5 or VZW S5 because of the BL, worse is that modifying system to get root is not possible according to CF. This was used to root the S4 and Note 3 orginally. The only way the ATT or VZW S5 gets rooted is if a dev is able to find an exploit for Kit Kat.
In short TMO S5 has an unlocked BL and ATT is locked, stop being in denial. Class over.