According to "Locking/Unlocking the Bootloader" docs (https://source.android.com/docs/core/architecture/bootloader...), "(...) the user needs to boot to the home screen, open the Settings > System > Developer options menu and enable the OEM unlocking option (...). After setting, this mode persists across reboots and factory data resets.".
My guess would be that if OEM unlocking stays disabled, phone reverts to "greyed-out" setting after each factory reset (yeah, that would be an issue if Google suddenly decides to send Android to graveyard...). I believe actual bootloader unlocking happens inside fastboot mode, outside regular OS and without access to WiFi/cellular data - enabling OEM unlocking is only a prerequisite to actual unlock.
"Magic hostname" mentioned in article (afwprovisioning-pa.googleapis.com) makes me believe this may be related to zero-touch enrollment of Android Enterprise/Android for Work (https://support.google.com/work/android/answer/7514005). I'm sure devices sold to regular customers and enterprises are identical and nobody is going to unbox and pre-provision them before shipment, so unboxed phone needs to contact provisioning server at least once to verify that there is no pending zero-touch enrollment configuration prepared for it (which may prevent bootloader unlocking if device is enterprise-owned).
My guess would be that if OEM unlocking stays disabled, phone reverts to "greyed-out" setting after each factory reset (yeah, that would be an issue if Google suddenly decides to send Android to graveyard...). I believe actual bootloader unlocking happens inside fastboot mode, outside regular OS and without access to WiFi/cellular data - enabling OEM unlocking is only a prerequisite to actual unlock.