Because you can’t know which ones you “need” to lock.
You can definitely know this. Use
mvn dependency:tree -Dverbose