First off its not hardware unlocked, they have a special baseband. Now at the same time they can't just use the firmware/software .ipsw to restore and unlock because that doesnt edit the baseband. Now what I don't understand, I know we have bbupdate that APPLE uses to update the baseband during firmware updates. Why can't the dev team download the BB from a legally unlocked phone and use bbupdate to add it to a locked phone to unlock it. I guess that its possible but either:
A. Too difficult
B. They won't illegally share Apple and Infineon's copyrighted baseband code.
I'm guessing B is more likely but A is probable as well. Now i'm not great at this stuff but thats just my opinion. Feel free to correct me if I'm wrong.