[Google Pixel 3 Questions & Answers] i5lee8bit:
Woohoo! Back a while ago, when I was still on AT&T, I was researching Pixel 4 series and saw that bootloader was indeed unlockable once SIM is unlocked (like Apple, SIM unlock is controlled on Google's side servers, but once whitelisted, not only unlocks the SIM but also "flags" the OEM unlock toggle to be allowed as well - unfortunately not the case for Verizon Pixels). Unfortunately I had problems with AT&T and eventually bought a factory (Google store) Pixel 4 XL and switched to Xfinity Mobile. Anyway, during all that research, I also saw that some Verizon Pixel 4 / 4 XL phones (iirc) were able to be bootloader unlocked as well. There were a few theories, one of which (again, iirc) applied to older gen Pixels - this particular one being that as long as the phones were never turned on with a Verizon SIM inserted, they could be bootloader unlocked (some theories suggesting doing factory reset gymnastics and stuff). But this didn't work for everyone (actually, it didn't work for the overwhelming majority of people - a lot of people suspecting lies / hoax / misunderstanding). But now I'm starting to think this theory may hold some water, though. Perhaps when you buy phones from Verizon, they're doing something on their end that essentially processes your account info to the IMEI of the phone you bought, somewhere in the backends of their systems. That, or maybe they're doing something with the SIM cards to set up for your account and turning on the phone once before shipping to you (I have no idea, I've never been a VZW customer). Either way, the phone's IMEI gets to "phone home" to Verizon thus locking the bootloader.

But since we're buying these old stock, never touched, never processed / activated into their system, completely factory sealed Pixel 3 / 3 XL phones that are total virgins to Verizon's systems (other than being preinstalled with a VZW SIM card), maybe that's why we can unlock the bootloaders. I don't think it has anything to do with the exact firmware versions they shipped with. I believe I remember seeing people on SD having bootloader unlocked on various firmware levels. Hard to say which thread(s), because the deal popped up so many times in the last few months, but I definitely remember seeing scattered preloaded firmware versions being bootloader unlocked.

Another theory had to do with a mistake on Google's end. Some people got lucky, some people got EXTREMELY unlucky. Some phones were manufactured and branded for the wrong carrier. For example, a phone manufactured for Tracfone ended up being locked to Verizon (not sure of the specific carriers and whether vice versa but you get the idea). But some people would get a phone that should have been bootloader locked down (OEM unlock toggle disabled) but still be able to do so. Not sure if the latter is related at all to how we're able to unlock these, but I doubt it. These were very small batches that got mixed up in manufacturing. Right now, we're seeing definitely Verizon locked phones, old stock, that all seem to be able to be bootloader unlocked. I really do suspect that there is a "phone home" process when initially setting up the phone that seals the deal with ending up with a permanently unlockable bootloader.

Now, an interesting experiment (that I wouldn't wish for anyone to try to be honest, lol) would be to have someone buy one of these old stock, brand new Pixel 3 Verizon phones, and initially turn it on WITH AN ACTIVE VZW SIM CARD INSTALLED. See if that permanently locks the bootloader. If not, maybe Verizon's side only perma-locks these phones up to a certain date (like their activation server sends some sort of command to permanently lock the bootloader, but that behavior of their activation server is only active during a certain lifespan of the device)? Either way, it would be interesting if smarter people could somehow use this information to come up with an exploit to bypass the initial bootloader locking mechanism, whatever it may be, and allow bootloader locking on future Verizon Pixel variants (though you'd likely be screwed once it's perma-locked).

On an alternate note, I absolutely hate that these carriers are screwing us, the end consumers and ultimate OWNERS of the device, for no damn legit reason. Ok, I can somewhat understand that they want to prevent modifications to the device to use their network (and by understand, I mean BARELY understand). But once the phone reaches end of life, ALLOW US TO UNLOCK THE DAMN BOOTLOADERS!! Otherwise, they should automatically chop off the sale price in half to whatever is the best current price from another vendor. F|_|CK Verizon and AT&T!

100% definitely Verizon branded. They're factory sealed, and come with a preinstalled Verizon SIM card. Also the IMEI starts with 35, and (unfortunately) the eSIM is locked and unusable. Like I posted in the OP, the box shows it's a Verizon locked variant.