I personnally keep OEM unlocking enabled so that if an update fails and my device is broken, I can unlock the bootloader to reflash it.
disabling OEM unlock prevents anyone why steals your phone from reusing it and scanning the storage, but if a bad update happens and your device can't boot, it's bricked.
As the storage is encrypted and unlocking the bootloader erases the storage, I keep it enable to make sure I don't lose my phone but high qualified engineers may be able to get some data, but it would be very complicated.