Okay so the general lockup issue is in KDE upstream's court then. I'll talk with the rest of the security team next week about the loosening of the polkit actions. It's a bit of a strange corner, because the display managers always allow shutdown/reboot without password entry. So having it restricted in polkit is useless.