You might not be aware, but the wallet supports encrypting. Which then
means that when Mr Badguy steals your wallet.dat, he cannot do anything
with it without the passphrase. See RPC calls 'encryptwallet'
'walletpassphrase' and 'walletlock'.

Also i'd like to say, that adding a big waving flag in the blockchain to
say you are locking/unlocking your wallet might not match good privacy
ethics ;)
​
--
buZz