To my knowledge, the KMS server settings were locked so they could not be overwritten by "normal" KMS servers.
KMS server can be set in two ways: Global - Windows and Office both can use that server. Specific - Only the specified products can use the added server. So, if you add a global KMS server to activate Office, it's going to activate Windows as well if the KMS key is installed. KMS server activation is for 180 days, so if Windows is activated with KMS38 (till 2038), the system will replace it with a 180-day KMS activation. To workaround this issue, so that if the user wants 180 days KMS for Office and KMS38 for Windows, we set a specific KMS address to the Windows product only and add a localhost address (not a valid 180 days KMS server), so KMS38 won't be affected by the 180 days global KMS server. Later, to make sure that when the user tries to activate the office using other KMS tools (MAS and KMS_VL_ALL can handle this without breaking KMS38), they won't replace KMS38, we started locking that specific KMS address registry. Now we are just adding a specific KMS server registry for Windows in KMS38, but not locking the registry anymore because that's kind of not a very good thing to do to touch the system in that way. Users now have better options to activate Office (Ohook, TSforge), and even if they want to use KMS, it's fine with KMS_VL_ALL and online KMS options in MAS. And even if they want to apply KMS commands manually for the office, it's fine because those normal commands don't touch the specific KMS server for Windows. Considering pros and cons, we have decided not to lock the registry anymore and keep it clean and nice.
4-6 Years ESU is not officially supported, but you can manually install Server 2008 R2 x64 updates until Jan 2026