A security feature: https://www.privacyguides.org/en/os/android-overview/#verified-boot

Isn’t it necessary lock it to get verified boot?

Some have an interview process in place (notably redacted). Once you get in a first one (either through interview, open signup or any other way) you can start climbing the ranks, at some point you should have access to an invite section on the tracker forum where you can find invites to other trackers (not all trackers have an invite forum and they don’t have access to the same invites).

This, of course, can only tell you if an apk is malicious, it cannot tell you if it is not malicious.