Many devices are indeed locked down. But given that it's an OS company and hardware vendor, many employees have access to hardware with e.g. SoC fusing that allows them to install custom-signed firmware. It's very difficult to make an OS lock out the people whose job it is to build the platform that OS depends on.