They are locked, but as anyone who has watched 20 seconds or more of the Lockpicking Lawyer, the locks are trivially easy to defeat. Typically they are in an unsupervised area of the post office and most of the time there “isn’t budget” to even cover them with cameras, as if a premeditated thief would not just show up wearing a disguise anyway.