In the UCP, users can delete their attachments (if the feature is enabled), regardless the status of their posts.

Indeed, users cannot edit or remove their locked post BUT they can still delete the attachments in the locked posts. Normally, if a moderator or administrator decided to lock a post, he/she wanted the author isn't able to alter the locked post in any way. Therefore, it's definitely a bug.

Someone has been already aware of this flaw since 2010 and another person suggested to disable the module in the ACP (see https://www.phpbb.com/community/viewtopic.php?t=2101097) but entirely disabling the feature in the UCP is not a satisfactory solution. Admins could want to let the users to manage their attachments, except for locked posts. Moreover, some admins may be not aware of that bug.