locking it doesn't prevent it from being used, it prevents it from being programed/ defaulted.
The NSI/ SSAIB companies are supposed to get written permission I believe, probably find its in the sale agreement with the charge to unlock it.
It is considered reasonable to lock it and that a fee can be charged if a site visit is required to unlock it. It is locked as a security feature and for the installer companies liability, if the end user changes any settings because they have the engineers code and the system does not work, along with many companies have generic codes so they disclosing it to an end user would put all there systems at risk.
I don't like systems that lock the engineers code only, some lock the NVM completely which is better, as attempting a default doesn't lose the programming. locking the engineers code only means everything else defaults and nothing can be changed.
In general if you are a competent alarm diyer, you can often replace a small basic domestic systems panel or pcb for less than a call out fee.
I have done take overs where security companies will either give the engineers code to me as an engineer or default remotely or charge and come to site. Although some have been known to be awkward, trying to protect their business interests?
several customers of mine have successfully got engineer codes from alarm companies apparently by threatening legal action, however these particular cases involved companies that didn't finish the install as quoted for, so a little more complicated.
There is no agreement between the new homeowner and alarm company, so CAB would advise on where you stand legally and that wouldn't cost a penny for the advice, I suspect there is little you can do, given the panel and whats involved and you want the engineers code to make the changes yourself its cheaper in this case just to replace the panel, which would give you a warranty as well.