> 3rd party lib or not, composer.lock MUST NOT be ignored. During Composer install, the dependencies of this library will be installed according to what has been prescribed in the lock file

This is wrong, See : http://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file (the blue block) or http://getcomposer.org/doc/02-libraries.md#lock-file

Note: This is fun, this is the same link. But I think you did not read everything.

> Without the lock file, the developers of this lib has no control over what version of dependencies the end-users can ultimately install. 

Yes, it is possible thanks to `composer.lock`. Everything is in the doc, but if you want, I can explain that here.