I think this is working as intended, though "intended" here could be un-intuitive. This is what we call "dock mode", and it definitely intends to keep the screen unlocked when you close the lid with an external monitor connected, and keep the screen unlocked when you re-open the lid.

The idea here being that folks who dock their computers and use them with an external monitor and keyboard/mouse combo want this behaviour: lock the screen when nothing is connected to it, but let me keep working when something *is* connected.

Using this as part of an attack would require physical access to the computer, and moreover would require the victim to not notice that there was a monitor on their desk, and if there were, to not notice that it was plugged in into their computer. This appears to be a little far-fetched.

One interesting corner case is that, at least on a MacBook Pro, if you plug an external monitor, see your desktop extended to said external monitor, disconnect the external monitor, and then open the lid back, the screen won't be locked. I don't have a Chromebook with a DP port here to test. Maybe the behaviour is the same. You could argue that if the monitor is disconnected while the lid is closed, the computer should lock the screen.

Given that the original report doesn't cover this corner case, this really is WAI, and at most SecSev-Low. Will leave open for discussion for a little bit.

Perhaps we could update settings descriptions (in particular "Sleep when lid is closed") to make this behavior more predictable? Definitely agree we don't want to break docked mode.

Updating setting descriptions would be a functional rather than a security issue.  removing restrictions.

We haven't had any other reports of this, I think most users understand the intended behavior. I'll close.