I believe the reason they do this is because some resellers were unlocking the bootloader and installing a ROM with malware and selling that off to unsuspecting customers. This delay (and needing to be registered with a phone number) makes that process both impractical and easy to detect.
This is true, but also really stupid. The resellers that insert malicious roms into their phones always manage to get a privileged account from someone at Xiaomi that allows for instant bootloader unlock, so only legit customers get screwed by this.