I don't know about the laws in the UK, but at least here, locking employee bathrooms, and requiring employees obtain a key or installing a keypad and assigning employees with codes for access, is not only perfectly legal, but in many of the buildings in downtown Chicago, it's standard practice.
Alternatively, some workplaces have cards, that employees are required to swipe to gain access. In some buildings, you are required to swipe your card to gain access to the building, and again to ride the elevator. Access can even be restricted to the floor you work on.
Why? In many larger companies, it's how they keep track of the employees who are late for work, how often employees take breaks, and to prevent outsiders from gaining access who don't belong there, while also saving on the costs of having to hire security personnel.
I provide accounting and bookkeeping services for various companies, some of which are located in downtown Chicago. Some have provided me with keys or a swipe card, while others have assigned me a punch code. So I'm used to it.
One of my clients was having problems with vandalism, and wanted to install cameras in employee bathrooms, but was told that could expose him to the risk of potential employee lawsuits for invasion of privacy. So he started locking the bathrooms instead, requiring employees sign in order to obtain a key for access. That did end the vandalism.
Why old anyone vandalize an employee bathroom? Either because they have a sick sense of humor or expressing anger at their boss.