Infrared device responds to multiple remotes/"wrong" codes
Shouldn't every device be sort of "locked" to a certain frequency too?


No, tolerances on carrier frequencies (in the receiver) are actually quite loose. Many devices use a simple 3-terminal integrated IR receiver1 that outputs a logic level signal that just indicates whether "carrier" is present or not. The only selectivity is provided by a bandpass filter inside the integrated receiver that typically has a bandwidth of several kHz.



1 Vishay is one popular vendor of such modules.