[Nexus 7 (2013) Q&A] wantabe:
I agree that it's not too much trouble to unlock the bootloader BUT... you will completely wipe your entire device everytime you unlock the bootloader! There is only one way that I know of to get around that. "BootUnlocker for Nexus Devices" is supposed to be able to unlock the bootloader without wiping the device but for it to work you will have had to unlock the bootloader to gain root beforehand, then you can use the app to lock unlock. I've never used "BootUnlocker for Nexus Devices" so I can't make any claims as to how well it works or if it will continue to work after future updates. If you ever want to fastboot flash the factory image or parts of a factory image the bootloader will need to be unlocked. And as far as I know to flash images with a toolkit (I don't use any) like Wug's the bootloader needs to be unlocked. Unlocked bootloader from a security standpoint? You're absolutely right that there is a risk! IF your device physically ends up in someone else's possession. We do have the "Android Device Manager" now that gives the ability to locate and wipe our devices. And, I have an additional theft warranty provided by Ruger so I don't spend much time worrying about losing any devices. ; ) There are much bigger security risks from just being rooted and/or having "unknown sources" enabled, web exploits and sideloaded apps. Unless you leave your device completely stock and unrooted, relocking your bootloader can create a significant hurdle that needs to be overcome to solve problems, especially for inexperienced android users. For what it's not worth, just my 2 cents! ; )

Update: after doing some research and installing BootUnlocker it seems to work well! Sweet! I don't need it and prefer to just stay unlocked so I'm deleting the app. Downside of having a locked bootloader is if you can't boot up and want to flash the system or factory images you'll need to "fastboot oem unlock" which equals "wiped device"

I think you and I feel the same way about OTA updates. I've always felt that flashing the factory image will provide a much more consistent and reliable result. I'm not a big fan of using the OTA's but do use them occasionally for very small updates like 4.4.4. Usually the bigger OTA updates will fail because I have too many modified files in the system and because they are bigger I would rather flash the image anyway. Generally, for the most part, I will open the factory image and pull (extract) from there the specific images that were updated in the OTA and fastboot flash those. On the N7 only the system image was changed with the 4.4.4 update. The 4.4.3 update changed the boot and system images. You can either flash the images that are needed for the update individually or the whole factory image. Flashing the individual images will not wipe your storage, settings or user apps and the factory image Can also be flashed without wiping your storage, or losing your installed apps and settings. When you extract the factory image you will see;

bootloader-flo-flo-04.02.img

flash-all.bat

flash-all.sh

flash-base.sh

image-razor-ktu84p.zip

Inside the "image-razor-ktu84p.zip" is where you will see the individual images;

android-info.txt

boot.img

cache.img

recovery.img

system.img

userdata.img

To flash the factory image without wiping data all you have to do is open up the 'flash-all.bat' with editpad lite or whatever notepad you use and remove the -w from the text. The -w flag will cause the userdata.img to be flashed which wipes your device. If you really want to make sure the os is clean you can do a factory reset with TWRP after flashing the images which will wipe the cache, data and dalvik and remove any settings but will leave your storage intact. I seldom do that though. If you are using a custom recovery it will be replaced with the stock recovery image when you flash the factory image which is why I generally flash the images separately. Not a big deal though because it only takes a few seconds to fastboot flash a custom recovery. My bootloader is always unlocked and I always have TWRP installed on my devices. Leaving TWRP installed gives the ability to flash an OTA that you sideloaded if you don't want to wait for it to get to your device. When you flash the system image, factory image or an OTA you will always lose the supersu binary which causes you to lose root. Before booting up after flashing the images you can go into your custom recovery and flash the supersu zip to regain root. Which is what I always do and I always leave a recent copy of the supersu zip on my devices. I always recommend learning how to use adb/fastboot, toolkits work fine for a lot of people but learning adb/fastboot is not hard and gives you more options and a better understanding of what is being done. A lot of problems you see posted here in the forums are from inexperienced users that are using toolkits. Just saying! ; )