Locking user profile fields is not working. Seems like a logic/typo bug.
Example: manual auth plugin. As I understand, configuration about locking fileds is performed inside admin/auth_config.php. For set_config() hardcoded plugin name uses as plugin/name, in our example it would be 'auth/manual'. But plugin itself saves its config as 'auth_manual'. So in db table config_plugins there are both data for 'auth/manual' and for 'auth_manual'.
During initialization auth plugin reads its config only for 'auth_manual' and therefore don't get anything about locking fields (because it was saved for 'auth/manual' as mentioned earlier).
Inside admin/auth_config.php there is a trick (I think it is for compatibility):
$frmlegacystyle = get_config('auth/'.$auth);
$frmnewstyle = get_config('auth_'.$auth);
Why there is no such trick inside plugin's code?