Tethering with locked boot loader A recent OTA update to KitKat removed the ability to tether my phone. I feel very frustrated by this bait and switch since I bought the phone for its ability to tether. The workaround is apparently to unlock the boot loader, gain root access, and then change a flag in a SQLite database. I'm aware that this introduces certain security risks. Is there a good way to have tethering without the security risks? E.g. could I unlock, become root, change the flag, and then relock? Most of the information regarding unlocking is in the context of installing custom ROMs and maintaining root access, which I don't have any particular desire to do. I really just want to change this one setting. Would this procedure enable future OTA updates to work? Are those updates likely to revert the value of the tethering flag?
The post you link says that a more recent OTA update fixes the problem. If you're not comfortable rooting the phone, I suggest you wait a few days and apply that update when your phone offers.

To answer your other queries about rooting: yes, you can unroot again (and lock the bootloader) once you've changed whatever settings you like. While the phone is unrooted, OTA updates will not apply. Applying an OTA update afterwards may undo the settings you've change: we can only guess whether they will or not. In this case, since the next OTA update fixes the problem, it probably will change the tethering flag.

FWIW, the problem you're seeing isn't that the phone doesn't have the ability to tether any more. KitKat adds new tethering features, and it seems (from the descriptions online) that the update had the accidental side-effect of making T-Mobile (and some other carriers) think that your plan doesn't allow tethering when it should.

Whether tethering is allowed is a matter between you and your carrier, not Android. If tethering is disallowed in your contract with the carrier, and you try to do it anyway, they have every right to stop you. Many carriers have other means to detect and block it that don't rely on the phone. It seems to be an accident that users on some carriers are being blocked when they shouldn't be, and that's what the work-around (and the official update) avoids.