While MX uses Java Data Structures that are designed to be thread safe, it is still considered best practices to lock
Code that is correctly locked could (assuming it is otherwise correct) be proved to do what it's intended to do. Code that is not correctly locked may give different results depending on what other requests may be concurrently modifying shared data; no theorem can account for this.
Code that is correctly locked can be run on a CF MX installation or a CF5 installation.