Were the lock files not checked into version control? It sounds like the problem was that different environments had different versions of dependencies, which is what lock files are meant to solve.
It partially helps but in the article I mention the package it had a change, a minor (non-breaking) one, that caused A to affect B without us having a direct explanation as to why.
Locking helps on packaging, it reduces the problem of packages being updated without your control but it doesn't help interdependency or the other things I mentioned (not even talking about security here)