Most non-UK domains use a transfer lock and an authorisation code, often called an EPP code or auth code, when they are moved between registrars.
UK domains work differently. Domains such as .uk, .co.uk, .org.uk and .me.uk are transferred by changing the domain’s registrar tag, historically called an IPS tag.
This means a UK domain does not normally need to be unlocked in the same way as a .com domain. The current registrar changes the tag to the new registrar’s tag, which moves management of the domain.
This does not mean that anyone can transfer your UK domain. The transfer still has to be requested by the registrant or by someone authorised to manage the domain.
Changing a registrar tag is separate from changing nameservers or DNS records. A tag change moves the domain between registrars. DNS changes control where the website and email point.