I have no idea why you think a security researcher shouldn't know how virtual locks work and be able to penetrate them, in my mind it seems a reasonable skill test, and so why you think this is immoral is completely beyond me.
Would you have the same objections if the test was a complicated SQL injection?
Would you have the same objections if the test was a complicated SQL injection?