When pages are locked, they're not limited to only admins (who I'm assuming you are referring to by "moderators"; otherwise, any user can undo an edit, and it doesn't require an account). There are several levels of page protection: [0]
* Pending changes protection: Anyone can edit, but edits must first be reviewed before becoming visible. Autoconfirmed [1] users have their edits go through right away, while other edits have to be approved by a pending changes reviewer. The criteria for reviewing edits basically boils down to "anything that is not vandalism" is reviewed and then it's treated like a normal edit that can be contested by other users. In effect it reduces the incentive to vandalize or make disruptive edits because they won't even be visible.
* Semi-protection: Only autoconfirmed users can edit. See [1]. This is used for pages where a large proportion of the edits are vandalism rather than helpful edits. 99% of vandalism stops here because most vandals are too lazy to get autoconfirmed or don't know how, since their goal isn't really to be productive.
* Extended confirmed protection: This is a fairly new option and requires an account 30 days old and with at least 500 edits. This is mainly used for pages under sanctions (namely the Israeli-Arab conflict), and in certain cases where autoconfirmed users are causing abuse.
* Full protection: Very rarely used. Mainly used in instances where multiples experienced editors are editing disruptively on a page such as by edit warring. The protection is always very short because it otherwise blocks editing from all users. In most cases though, the editors themselves are usually blocked or warned instead of a page necessitating full protection.
[0]: https://en.wikipedia.org/wiki/Wikipedia:Protection_policy
[1]: Account must be four days old and have made at least 10 edits, so not hard at all to obtain