You are Al
If new Co did as they should no problem. But if new Co isn't approved and or not insured the sites insurance will look to the firm that is.
Modern times of litigation you need to protect yourself or you will find you may have breached your own insurance terms.
Not if the incoming Co doesn't default as the original programming remains. If the original programming for whatever reason is argued to be at fault because the original programmer can't prove it has been changed may be liable. An insurer won't take that risk
I disagree I'd lock it, but would charge to unlock. But would reset it for free if the board was dropped off. It's not to lock in a customer it's to protect the company from malicious claims.
I'd assume the outgoing firm would do something similar