I am not sure where the boundary is, but it should be required to not encryption lock your devices from custom firmware/data.
It would be fair to have a locked / unmodifiable initial boot step which shows a visible "unsecured" indication on every boot. If you installed a custom OS you can ignore this, if you didn't, you can worry.