Presumably it’s for the transitive dependencies. You pin action X, but that (third party) action doesn’t correctly pin the SHA of action Y, so you still get owned if the mutable tag gets moved to a compromised commit.

But with a lockfile, direct and indirect dependencies both get pinned. (I presume, and haven’t checked yet, but otherwise this feature would be useless)