Locked domains are domains which require additional hoops be leapt through in order to change ownership. The lock is requested by the owner of the domain and implemented by the registrar of the domain.
Historically, transferring ownership of a domain required something like one of the authorized contacts faxing in a signed paper. And, believe it or not, there were people out there who would fraudulently sign papers and fax them in so that they could steal the domain. It's called Domain Hijacking and during the dot-com era it was a reasonably large problem. It happened to my company around 2000 and it took us months for the lawyers to convince Network Solutions that the domain had been fraudulently transferred and that it should return to us.
Domain locking means that the registrar must unlock the domain before making changes, and that therefore they are triggered to apply extra scrutiny to the transfer. Some might argue this merely makes them "do their job"...
The law of unintended consequences means that domain locking became a weapon in the registrar wars. As new registrars came online and tried to capture business from the (more expensive) older registrars, domain locking was urged upon domain owners with the unstated goal of making it harder to hop from one registrar to the next. Every domain registered at Network Solutions "comes with the free Domain Protect feature enabled," for example.
Your biggest question seems to be is domain hijacking an important threat?
Yes, but relative to the value of your domain. For example, "sex.com" was an attractive and lucrative target (link goes to article, not named domain). Other domains would have lower value.
I was unable to find a way to query ICANN to find out which TLDs support domain locking, but I was able to find this (very comprehensive) list on a registrar site which indicates that .co does support domain locking:
And, if you go to the .co whois server, you can see that locking attributes are listed for their domains:
For at least two of the TLDs listed as not supporting domain lock in that list (.cn and .uk), I pulled up whois details for a couple domains and did not find any indication of EPP status codes that would indicate domain locking. (As a negative inference, that's of limited use, but it beats contradiction).