A registrar cannot lock a .nz domain. 

But the DNC can lock it when its going thru the DRS (Domain Resolution Service) for decisions about unfair registrations or working out who has the rights of a domain.

Here is the official part about locked domains..

https://www.dnc.org.nz/content//tar_2.0.html

"...3.9 A domain name that is locked cannot be transferred except through a manual transaction undertaken by NZRS. An application will need to be made to the Domain Name Commissioner ("DNC") for this to occur. Note - a locked domain name is intended for situations where a court (or other recognised authority) orders a "freeze" in respect of a domain name until a full hearing on the issue can be held. Whilst the lock is in place the domain name cannot be amended in any way by the registrar...."

Regarding who to go for your domains,  I have all my domains via Metaname who seem to do a good job.