It's probably done through normal write commands if there is any explicit lock bit at all (it could doesn't just check if any of the UID bits are already non-zero and then reject the write). You can actually make other parts of the memory read-only too by setting bits at a specified address [0] (which then cannot be unset again).

[0] https://www.nxp.com/docs/en/data-sheet/MF0ICU1.pdf#G4008599