Mods already have the ability to lock posts, so the functionality you're asking for already exists in a more general context. So, the question is whether or not to use it.
Generally speaking, status-completed questions stay open and available so other users can point out regressions. That is, the question is neither locked nor closed. I should also point out that any user with < 3k rep pretty much has no real way of drawing attention to a closed question (edit/retag + comment is weak at best). Even at 3k, a reopen vote + comment may not do much as only 10k users will see that in the tools. This doesn't make sense, particularly for an urgent issue (i.e., XSS).
Exceptions to this rule include localized issues such as merging user accounts. Once it's done, it's done. (For this specific example, once it's complete, the question itself is usually deleted as it's no longer relevant or valuable to keep around.) Even so, a closed question still allows users to comment, so it's not entirely unavailable.
Really, I don't see any advantage to close (generally) or lock a status-completed question.