When purchased from the Play Store, it's unlocked. If purchased from Project Fi, it's unlocked if you either cancel your Project Fi service, or replace it with a Project Fi compatible device like the 5X, 6P or Nexus 6

Not true at all... if you buy a 5X from the Play Store, Amazon, some dude in an alley, whatever, and activate it on Fi, then put your Fi SIM in another phone and sell the 5X, it'll still show as active on Sprint and fail a FED check (which prevents the buyer from activating it). Has nothing to do with where you bought the phone.

If you buy a 5X (or any other phone!) from a dude in an alley and activate it on Freedompop, then forget to kill or move your Freedompop account when you sell the phone, that phone will fail a FED check.

T-Mo should pull the IMEI off your account as soon as you power up another phone with your SIM in it (as should AT&T and usually Verizon).

Sprint doesn't work that way, partially because their system is old-school and partially because it protects them and their MVNOs from people buying subsidized phones and switching to another MVNO. Verizon has a similar practice but only with phones sold by VZW prepaid.

A phone that's actually locked will refuse to accept a SIM not from its carrier. While I suspect it's technically possible to subsidy lock them, in real life no one sells a locked 5X.