but if the hardware isn't locked down so the software need to be signed, you can just rebuild with all the restrictions removed
So? There is no need for a hardware lock-down, because it is trivial to build a device that messes up that part of the spectrum anyway.
It is not the possibility of an expert using the device in a harmful fashion that the legislators want to avoid, but the case where lots of end-users have cheap but harmful devices in use!
Look at it this way: Do you need to ban an engine that works perfectly fine within regulations using standard fuel, but can also be run using highly poisonous, high-performance rocket fuel? No, because the illegal, restricted part is using prohobited fuel, not having an engine that
can run on illegal fuel. (At least in Finland this analogy works: most diesel engines can use furnace/marine oil, and some actually do (because it is lots cheaper). Yet, those diesel engines are legal. It is only illegal to use furnace/marine oil in diesel engines.)
In other words, the idea of a hardware lockdown makes only sense if it would otherwise be difficult to produce the emissions. But it isn't. It's dirt cheap. And people do, when they hate their neighbours, and don't want them to have a WiFi connection; they can just build them from scratch, for comparatively little effort. You cannot ban the components, because they're ubiquitous.
The same thing applies to certain explosives and fuel jellies (napalm). You can easily make them from household stuff. Yet, the household stuff is not illegal. It isn't even illegal to describe the chemical compounds and reactions used. We're just hush-hush about that, so that governments do not need to intervene. The thing that is usually illegal is to put out a handbook on how to create improvised explosives. Similarly, an open-source firmware should make it easy to follow the various regulations based on location, but non-obvious to a non-programmer how to change the limits and ignore the location setting. So, no
#define FREQ_MIN type of stuff in the code; but no hardware lockdown either. (Instead, you have e.g. byte arrays defining the settings for each locale, with a text file somewhere describing the math used to calculate them.) Otherwise, we'd have to ban all sorts of household chemicals, and most detergents, so that evil chemists won't blow up stuff.
As far as I can tell, open source firmwares are currently treated analogously to self-monitoring agricultural supply stores. If they don't make it too easy for nasty people to mess stuff up, they're not blocked by legislation.
Really, the largest opposition is by the manufacturers themselves, who do not want them opened. Could be due to fears of copyright infringement, but I suspect inter-company licensing agreements and pure company management strategies are at the core. Whenever you hear a politician or similar talking about this stuff, there is a recent visit by a big industry player in the background. And then there are patents.