TLDR: No, Unlocked Packages cannot be used like this. Anyone commercially distributing a Salesforce app must do so using Managed Packages. Also, Managed Packages offer many valuable features simply not available in Unlocked Packages.
This is a great question, Robert! Thank you for asking it.
I'll do my best to answer both parts of this question:
- Can someone distribute an app using unlocked packages?
- Should someone distribute an app using unlocked packages?
Can someone distribute an app using unlocked packages?
First, since your hypothetical Salesforce Developer is "working with Salesforce code that [they are] delivering (for money)", the exact situation we need to consider is the commercial distribution of an application to a third party.
In order to create their app, your hypothetical Salesforce Developer would need to use one or more Salesforce development tools. This would include, but not be limited to, DE Orgs, Scratch Orgs, the Salesforce CLI, etc.
Use of any of these tools requires the acceptance of the Salesforce Developer Services MSA. There's a lot of stuff in there, but here's the key bit:
You may not, without Our prior written consent, access or use any Salesforce services, including the Developer Services, to Commercially Distribute Your Application to third parties unless You are authorized to do so pursuant to a separate agreement with Us.
The "separate agreement" that's needed in this case would be the Salesforce Partner Program Agreement (SPPA). Again, lots of stuff there but here's the key bit:
To participate in the Partner Program, Partner must be enrolled in a Program Type. To enroll in a Program Type, Partner must fulfill the Participation Qualifications set forth in the applicable Program Type’s Program Policies, and be accepted for the applicable Program Type by SFDC
The applicable Program Type for our hypothetical Salesforce Developer would be "AppExchange Partner". The policies that govern the requirements of enrolling as an AppExchange Partner can be found here: Program Year 2020 Salesforce Partner Program Policies.
The key bit in the Program Policies doc is the list of "Participation Criteria" for AppExchange Partners:
- Completion of SFDC’s legal due diligence process, provided it results in approval by SFDC
- Participation in one of the AppExchange Partner Categories described in these Program Policies
- Approval of the Partner’s application(s) through SFDC’s Security Review and Assessment
That third bullet (bolded by me) is the important one.
All AppExchange Partners must put their apps through Security Review, and all apps submitted for Security Review must be submitted as Managed Packages. The only exception to this is when you're submitting an "API Only" app for Security Review (which makes sense because there's no Salesforce code to review in that case).
So, after all those hops from contract to contract, the end result is this:
Unlocked Packages cannot be used in the manner you described because anyone who wants to commercially distribute a Salesforce app must do so using Managed Packages.
Now for the second question.
Should someone distribute an app using unlocked packages?
I can see how Unlocked Packages may seem appealing in the short term, given the use case that Robert outlined. However, I would argue that the long-term benefits of using Managed Packages outweigh what seem like the short-term conveniences to the hypothetical Salesforce Developer.
Managed Packages give you many things that Unlocked Packages don't, including:
- IP Protection
- License Management
- Subscriber Console
- Feature Management
- Patch Orgs
- Push Upgrades
So, even if it weren't for all the legal reasons why the hypothetical Salesforce Developer MUST use Managed Packages, there are lots of reasons why they SHOULD use Managed Packages.