Which is why even "unlocked" bootloader doesn't let the user load his own code into TrustZone.

The name "TrustZone" is rather ironic. It's most commonly used to run DRM code the user should never ever trust.