The bootloader is locked by default on most (maybe all?) android phones, so unless the user has explicitly unlocked it, they'll be safe