Clarification on xss-lock configuration

Hello,

I have the current configuration in my i3/config file:
```
exec_always --no-startup-id xss-lock --transfer-sleep-lock -l -- i3lock --nofork
bindsym $alt+Shift+Delete exec --no-startup-id loginctl lock-session && systemctl suspend
```

I recently ran into the issue where, when using my shortcut to suspend my session, i3lock failed to grab the keyboard but xss-lock still ran suspend.

I.e. when resuming my session, there was no lock screen.

I tried many solutions and other lockers, but in the end the only one that seem to work for me was to use my own fork of xss-lock as described in [issue 311](https://github.com/i3/i3lock/issues/311).

Is there really no other solution? If so, shouldn't this workaround with xss-lock be explicitly written in the README?
The fact that the base xss-lock binary can suspend without i3lock actually grabbing the lock seems like a huge security issue to me.