The lock is in the radio part of the phone, a seperate processor and firmware, accessible through a radio interface (ril). GPL doesn't apply here.
To avoid having to deal with blocked AS, you have to monitor and control you customers. I scan all my ip addrs daily in the populars dnsbls. If a user gets listed, block direct outgoing mail (automatically), tell them to use the (scanning) smarthost and offer services to fix the source.
Mommy, what happens to your files when you die?