I've never known the specific reason why some methods in CWallet acquire the lock and others such as address book manipulation do not (and assume the caller already holds it). But it's always been that way.