symfony also does not do that, and with good reason: when you start a project based on the SE, you should indeed commit your .lock file into the project to only update when you actually want to.

it just means we have to be careful to not accidentally commit the file into this repo.