Why is the canon firmware obliging this?
Don't know. Autoboot feature is for canon developers or service, I guess they don't care about locked card.
The card reader knows the card is locked using data it reads from the card or using a mechanical sensor?
By mechanical sensor. The lock tab on the card is just a sliding piece of plastic, there are no electronics. So you can get a cheap card reader, open it up, and break of the little switch that touches the lock.
Basically you are saying that the G9 does not try to read a firmware update from the card unless it is locked?
It won't read DISKBOOT.BIN, the autoboot file. Firmware update is a PS.FI2, but to use this you must go through the "firm update" menu every time you start the camera.
