Security features are always optional and user has to _enable_ them, just like enabling devicelock code, will prevent thief to do factory reset as lockcode is queried before device can be resetted. And of course you would also need to register the device to prey (client can ask current lockcode before settings can be altered, so thief cannot just turn it off) or any other backend before remote lock or remote wipe or tracking commands would be possible.