I could be wrong, of course, but I don't believe that Apple stocks both locked and unlocked versions of every AT&T & TMO phone model and configuration. We don't see people complaining that they went in to buy a new phone (full price or financed) and Apple only had the *other* version available. Nor have I heard of any reports of buying a full price TMO phone to use on AT&T and then finding it was a locked version. It's this that leads me to think the locking occurs during activation in some manner.
Again, I could certainly be wrong. While that's a rare thing, it has happened a couple times.