Seems like something similar just happened to a colleague of mine as he is completely locked out from his Apple ID with an error message saying it is locked and can not be used. Is it a time based lock by any chance? It is highly problematic if Apple is automatically locking accounts without knowing why they are locking accounts like this.

It's surprising that Apple doesn't have a good solution for this which also works in browsers which isn't Safari. How hard could it be to allow a param to follow the user through the App Store and delegate it to the app after install? Especially if this param is an url which can be validated through apple-app-site-association as a valid domain for use with the app.

Have the same issue, sent Apple a message using the Feedback Assistant. Please consider doing the same to increase visibility.