I wasn't saying recovery could unlock bootloader, but rather, if OEM unlock is allowed, anyone could unlock from fastboot. Also, at least on Onepluses, recovery does the wiping, so if recovery is erased, there would be no wiping data. If OEM unlock is disabled, no fastboot action would be possible. Also, I think, although I never checked, that if EDL is disabled in kernel, that might prevent MSM flashing/backup.You're forgetting the MSM tools have readback mode. This allows an attacker to backup all the partitions anyway and flash them later, so bootloader lock doesn't have much practical security. Also, MSM tools can be modified, so I'm pretty sure you can disable wipe on flash. Regardless, the backup method removes any tangible security benefits.
Regarding recoveries being able to unlock bootloader, I'm not sure that's possible. You have to boot into fastboot bootloader mode, not fastboot recovery mode to unlock the bootloader. Unless someone comes up with a bootloader attack, it's quite difficult to unlock bootloader from recovery.