Here you have a little task that will help you to get more information than the 'KEYG' built-in variable, about the device lock status.
• Device Locked: The device is locked and asks for authentication in order to use it.
• Device Secure: The device is protected (service), regardless of if the protection mechanism is not currently required to use the device.
• Keyguard Locked: The device is locked and doesn't ask for authentication in order to use it.
• Keyguard Secure: The Lockscreen is enabled (service), regardless of if the device is locked or not.
The Device/Keyguard Locked represents the current state of the device, and Device/Keyguard Secure represents the general configuration of the device.