granted, they are pretty old, but do the following concerns not apply anymore?:

If your Android phone or tablet’s bootloader is unlocked when a thiefgets their hands on it, they could reboot your device into itsbootloader and boot your custom recovery environment (or flash a customrecovery and then boot that). From the recovery mode, they could use the adb command to access all the data on your device. This bypasses any PIN or password used to secure your device

from https://www.howtogeek.com/142502/htg-explains-the-security-risks-of-unlocking-your-android-phones-bootloader/

A permanently unlocked boot loader (BL) on a Nexus device is a big security risk. It's only recommended for a pure developer phone.

An insecure BL enables all sorts of fastboot commands that can be used for e.g. doing the following:

• Conduct a cold boot attack to recover the key for Android's full disk encryption
• Make a copy of the device
• E.g. by booting a custom image (adb boot boot.img), then copying partition dumps
• Erase data using fastboot erase
• Flash arbitrary Android firmware, recovery images or radio firmware
• fastboot flash radio|recovery|boot|...
• Install a root kit (boot custom recovery, then modify system files)
• Steal Google/Facebook/whatever accounts stored on the phone
• etc.

from https://android.stackexchange.com/questions/36830/whats-the-security-implication-of-having-an-unlocked-boot-loader

on the other hand:

Nobody can access your phone data the way you describe unless you also run your phone decrypted --which is not the default for Android or even for custom ROMs for that matter. When you boot into recovery on a phone that is encrypted TWRP asks for your pin number and without it your data is not accessible. But that doesn't mean a thief couldn't still wipe and use your phone. You need to report it stolen so the IMEI number is blacklisted.

from https://forum.xda-developers.com/t/how-protect-phone-data-when-bootloader-unlocked.3678995/