Xperia XA Security Settings. Is this normal?

[dmeddings]

Hi.

My Sony Xperia XA has the setting "Bootloader unlock allowed = No" which I believe means that no-one can root the phone or install a custom ROM?. I am checking over the phone because someone messed with it and I am concerned that they have installed some malware that will survive a factory reset.

I have been advised to check 'Service Tests/Security' via the dialer code to see if everything is OK, specifically to check that all the lines have [Key OK][Active]  after them.

My phone has the following settings:

CKB[Key OK][Active]

WIDEVINE[Key OK][Active]

PRODID_AID : 0004

OTP_LOCK_CONFIG : 0002

OTP_LOCK_STATUS : LOCKED

AUTH_ENABLE : 01

DEVICE_ID : 218AAEAB

As you can see there are several lines that do NOT say [Key OK][Active].

Can anyone tell me if this is normal for an XA, or are the missing Key and Active parts an indication that my ROM has been tampered with.

Thx D.

[dmeddings]

When I enter the dialer code to access the Testing menu on my Xperia there is a section called 'Service tests' and a sub-section called 'Security'. I have been told that checking these settings can reveal whether the phone has been rooted or flashed with a custom ROM, but I have no idea what to look for that might indicate a problem.

I understand that some of the entries refer to whether or not a DRM service is intact. For example, on my newer Sony Xperia the entries include:

WIDEVINE OK [ACTIVE]

On my older Sony phone it says:

WIDEVINE [Key OK] [Active]

My question is, what do the other entries mean? It would be great if someone could provide some examples of what each one should say normally and what it might say if the phone has been tampered with. The ones of interest to me are:

Factory reset reason :

Rooting status :

HUK :

PRODID_AID :

OTP_LOCK_CONFIG :

OTP_LOCK_STATUS :

AUTH_ENABLE :

FIDO_KEYS :

Security conf

My apologies in advance if there is already a guide to this somewhere.