Well, coming across G+ in a re-share bonanza, Steve Kondik has confirmed that the AT&T version of the Samsung Galaxy S4 does indeed have a locked bootloader. The device “authenticates the recovery and boot images before executing them” which means it checks whether or not things have been tampered with before it boots. If one wants to load custom ROMs which require a custom recovery, this isn’t the device for you. Until this bootloader gets cracked and software can be swapped out, users will be stuck in stock purgatory.
“I can’t see what AT&T has to possibly gain from this. GSM and LTE aren’t magical, tethering is controllable on the server side, and theft-of-services is not possible from the application processor side (or even from the modem side as far as I know). The same device is available on every carrier, so it’s not an exclusivity issue either. The modem processor has always been locked, and the casual user doesn’t want to mess with that part anyway. Samsung has always been developer-friendly, so I am guessing their hand was forced.”
Carriers typically have the final say in deciding whether a device gets locked or not. Note that the AT&T version of the HTC One is also supposed to have a locked bootloader and may in the future, but as I’m writing this it currently can still use HTCdev to unlock it (hold onto your unlock codes if you got them). This isn’t just a phenomenon of AT&T, last year the Verizon version of the Galaxy S3 shipped with a locked bootloader even though every other U.S. carrier (even AT&T) didn’t have one. It took about a month before that bootloader was cracked.
With that being said, the bootloader on the AT&T S4 more that likely will be cracked at some point, but don’t even bother waiting until then. Carriers have their own reasons for doing things like this. So, if you’re into modding, don’t waste any of your time trying to figure out why or getting mad at AT&T, just go with something else. Hopefully an exploit can be found quickly and this will be a non-issue for those who took a gamble, I also hope that one day all carriers will be consistently dev friendly…probably not.