Those statuses (what Cloudflare calls registrar locks) are more aimed at giving registrars a way to prevent the registrant (or anyone else) from making changes

Those statuses (what Cloudflare calls registrar locks) are more aimed at giving registrars a way to prevent the registrant (or anyone else) from making changes to a domain. It's commonly used during disputes over domain ownership, for example. Transfer lock, 2FA on your account, protection of the AUTH code (should be encrypted at least, or not stored at all at best) and a registrar with a support team that is resistant to social engineering hacks is sufficient for most domain owners. If you require complete security, registry lock is the way to go as it prevents changes to the domain from the top down. It would protect you from something like a bad actor with access to your domain through the registrar's system. That said, it's a real pain when you actually want to make a change since there's very specific protocols to follow. And you have to pay extra for it since the registry charges to apply the lock.