When a firmware password set on a Mac, the lock icon appears when you try to start up from another disk or volume, such as an external device (MacQuisition) or macOS Recovery.
Lock icon
A firmware password prevents users who don't have the password from starting up from any disk other than the designated startup disk. Apple has more information on firmware passwords here.
If you do not know the firmware password, Apple requires you to schedule a service appointment with an Apple Store or Apple Authorized Service Provider. You will need to bring the Mac and the original receipt or invoice as proof of purchase. Apple also provides this service to law enforcement with a search warrant.
For Macs that do NOT have a T2 chip, the firmware password can be bypassed by opening the Mac and removing the drive. This process is out of the scope of BlackBag Technical Support, but we wanted to still mention it. The website www.ifixit.com is a good resource for learning how to open a Mac and remove the drive.