Why does unlocking the bootloader wipe phone?

I understand that unlocking the bootloader will wipe my Android phone, but have been looking around for why. Seems to be by design, but what is the reasoning for that design? Is it some security concern, some obscure technical reason, or just for lulz? I'm looking for something solid to chew on here, something more than because "that's how it is".

Answer

It's a security concern. The Android documentation doesn't provide a lot of elaboration, stating simply:

The procedure must be confirmed on-screen, and deletes the user data for privacy reasons.

However, the privacy concern is relatively straightforward to extrapolate. Once the bootloader is unlocked, the device can be flashed with unsigned images. This means that it is relatively trivial to root the device, and there are actually multiple ways it can be done, such as:

• Flashing a system image with root tools built in


• Flashing a boot image that runs adbd with root by default (an "unsecure" image)


• Flashing a recovery image, then using that to overwrite the system or boot partitions with ones that allow root access

Once root is obtained, all of the information on /data essentially becomes accessible. This could be emails, contact information, or many other pieces of personal information that you likely don't want in the wrong hands. Therefore, it makes sense to wipe all of this data during the unlocking procedure to ensure that there is no off-the-shelf "official" way of bypassing the sandboxing restrictions implemented by the Android operating system, which would thereby allow someone to steal personal data.

Of course, there may be ways to root without wiping on some devices, but they rely on exploits rather than official methods like a bootloader unlock, meaning they are basically bugs.