tl;dr
No, you can't use fastboot boot
to boot into a custom recovery if the bootloader is locked (as Jerry Chin noted in a comment).
Longer Answer
Android Security Internals says in Chapter 13: System Updates and Root Access (in section Recovery, subsection Custom Recoveries):
A custom recovery is a recovery OS build created by a third party (not
the device manufacturer). Because it is created by a third party, a
custom recovery is not signed with the manufacturer’s keys, and
therefore a device’s bootloader needs to be unlocked in order to boot
or flash it.
And in Chapter 10: Device Security (in section Controlling OS Boot-Up and Installation, subsection Bootloader):
In order to ensure device integrity, consumer devices are shipped with
locked bootloaders, which either disallow flashing and booting system
images completely or allow it only for images that have been signed by the
device manufacturer.
Thus, if you try to use fastboot boot twrp.img
, the bootloader will find out that twrp.img
is not signed by the manufacturer's key, and would refuse to boot into it.
And just in case we are not sure whether fastboot
allows bypassing the restrictions that a locked bootloader introduce, we also have in Chapter 13: System Updates and Root Access (in section Bootloader, subsection Fastboot Mode):
Commands that modify device partitions, such as the various flash variations, and commands that boot custom kernels, such as the boot command,
are not allowed when the bootloader is locked.
fastboot boot
with a custom image and a locked bootloader, at least for my Nexus 6P, 7.1.1.