Rant: Why is SIM unlocking a Z2 made so needlessly dangerous?

Question

I just bought a second-hand Z2 locked to the EE network. Last night I finally unlocked it using a code I ordered a few days ago from a website.
Now, I can sort of understand the business logic of locking a phone to a network. It goes something like: the contract is subsidised and does not cover fully the cost of the phone and network use, so the network depend on the phone being used and the customer using additional services that bring them the missing revenue to cover costs.
To unlock the phone costs money which, I assume, covers the losses to the network provider.
A typical scenario for unlocking the phone may be, say, that I am on a business trip in a different country so I want to use a local PAYG SIM to get up and running with my phone. So I purchase the SIM, pop it in the phone, and oh-oh! It's locked.
OK so far. Now what I have a problem with is the following....
Wherever you order the code from, it takes 2 to 8 days to arrive. Is it really that difficult to find? If I was travelling and hit the phone-locked problem then my trip would probably be over before the code even arrived. Who and what is sitting on that code for all that time and why? Even a black-list check takes only a few seconds. I know because that's the first thing I did before shelling out £20+ for the unlock service. Really. This service should happen instantly, online, and be hosted either by the network or the phone manufacturer rather than having to search all over the Internet for a third-party unlocking service I can trust. Although the networks will provide unlock codes they will only do that to the orginaly customer, which immediately rules me out since I bought the phone second-hand, and they will take even longer than 2-8 days.
There is a limit of 5 unlock attempts (or 10 if you are lucky). When these are used up the phone is permanently locked to the network. The only way to reset it then is to use a special tool that only certified Sony repair centres have. When challenged for the unlock code when I put the new SIM in, I was not informed on the screen that there was any limit, how many attempts there were left or where this code should come from. So imagine I have arrived in a hotel in another country and I find this message when I put my new SIM in the phone. What number should I use? Is it the old SIM number? The new SIM number. The IMEI number? Old phone number? New phone number? Let's try them all! Ooops! What the heck is this restriction designed to achieve? Bear in mind that the unlock code is 16 digits long. So how many millions of years would that take for someone to guess it by chance? Even if there was some software that could attempt to brute-force it, it would take considerably more than 5 attempts to crack a 16 digit code. To foil a brute force attack is as simple as slowing down the attempts to one every second. The limit of 5 attempts is unnecessary unusually cruel to the end user who has paid £100s for their phone.
When I type in the code it is treated as a password with the digits hidden from view. This is really not what I need when I only have one or two attempts left. I want to be able to check and double-check that I have all the digits correct because if I haven't the consequences will be severe and probably quite expensive to fix. Why hide the code on the screen anyway? If someone was reading the code over my shoulder (which is the point of having asterisks covering password characters) what could they do with the code anyway? It only works on one phone. Once used the code has no further use to anyone. So for goodness sake make it visible.
I am interested if anyone out there can shed some light on why all these extra and unncessary pitfalls are placed in front of customers. Is there any commercial reason for it? Are the SIM-locking-mechanism developers clueless or just sadists? Did Sony have to impress the Network providers' guys in suits with Fort-Knox-level, but pointless, "security" features?
I notice that there are some online petitions against the practice of SIM locking in general. If the networks and manufacturers want people to accept SIM locking then they better had make the process of unlocking a phone clear and straight forward and remove these stupid delays and hurdles that insult the customer and their investment in the phone.

Answer 1

HI @Johan,
OK. I understand that the network operator holds the unlock code and this is not a specific Z2 issue.
Regarding the software, although the network operator may well be able to define things like what parts of the phone are locked e.g. SIM, bootloader etc, the mechanism of enterting the code, limiting retries, using a password box for the code etc. are common to all Z2s AFAIK. I've never seen any opertator-specific instructions for unlocking a Z2. Only Z2 specific. They may be able to set the number of retry attempts but probably not change the whole implementation.
The unlock screen may be written on top of Android but it isn't part of the Android since it is Sony Z2 specific. Whoever coded it had the choice of using a password box or a normal numeric box. They chose a password box.
The purpose of posting was to draw attention to what I see as unnecessary pitfalls in the unlock process, gain some consensus from the community and hopefully eventually get the attention the Sony developers so they can improve future phone designs. BTW, I have already posted a message to Sony Support feedback/suggestions.
So, just to summarise the issues:
Unlock screen does not warn or inform user of limited attempts
Limiting the attempts is redundant since guessing a 16 digit code is virtually impossible
Not covered in instruction manual
Using a password box instead of a numeric box to enter the code is redudant
What I would like to see instead is:
Procedure covered in instruction manual
No limit on attempts. If software cracking tools are considered a threat then delay retries to maximum one-per-second
On-screen information explaining what code is required and how to obtain it
Use a plain text box to enter the code into so the digits can be seen