If you see auth code as easy, they can't do something about transfers. Yes, they have chance for cancel transfers but they can't. Because they are icann registrar. I think they don't want any trouble with icann.
If they don't cancel or if you don't cancel transfer as manually, transfer will complete AUTOMATICALLY in 5 days
without any manual approve.
For example, very hard to transfer away from networksolutions.com and from register.com.
Because when you try transfer to out any domain, they don't give you transfer authorisation code from panel. You must wait them for manual investigation on your account. If positive, they send your auth code after 5 days. Yes, very hard for transfer, but they can't do something more. Because they are icann registrars too.
Godaddy have some rule too like this. If you change domain contact name etc. you can't transfer away for 60 or 90 days after change contact.