That sounds really screwed up, sorry to hear that.
Where does the Apple ID come into all this - is that T2 special sauce or something that only gets hooked up if you follow the macOS install procedure to the letter? I always skip any iCloud stuff and try to stay as offline as possible when setting up.
I also never fill in security answers in earnest and nobody gets mom's actual maiden name so this sounds like it would really bite me too.
I guess you'd have to prove ownership of the computer to Apple to make them unlock it? Purchase receipt and a trip to the genius bar.
Btw.
@andyherman : since you mention HP workstations: careful with Windows in that regard too. If your accounts are created online like MS wants you to then they too can lock you out of your machine in similar fashion. I had to disconnect ethernet during install to force an offline user in W10, apparently in W11 it's currently unavoidable though.