Presumably it’s for the transitive dependencies. You pin action X, but that (third party) action doesn’t correctly pin the SHA of action Y, so you still get owned if the mutable tag gets moved to a compromised commit.

But with a lockfile, direct and indirect dependencies both get pinned. (I presume, and haven’t checked yet, but otherwise this feature would be useless)

You can keep the information provided by the version number, and if the maintainer is using real SemVer, it's easier to upgrade.