May I please ask whether an unlocked bootloader is still bad for privacy and the risk of data loss/theft, if the phone is enrypted?
My understanding is that while being able to mess with the phone (e.g. including installing a new OS) in the presence of an unlocked bootloader, a properly encrypted phone at least protects the data on it.
Did I get that wrong?

How so?

Signal also uses our metadata encryption technology to protect intimate information about who is communicating with whom—we don’t know who is sending you messages, and we don’t have access to your address book or profile information. We believe that the inability to monetize encrypted data is one of the reasons that strong end-to-end encryption technology has not been widely deployed across the commercial tech industry.

Source: https://signal.org/blog/signal-is-expensive/

I haven’t verified that claim investigating the source code, but I’m positive others have.