You might not be aware, but the wallet supports encrypting. Which then means that when Mr Badguy steals your wallet.dat, he cannot do anything with it without the passphrase. See RPC calls 'encryptwallet' 'walletpassphrase' and 'walletlock'.

Also i'd like to say, that adding a big waving flag in the blockchain to say you are locking/unlocking your wallet might not match good privacy ethics ;)

buZz