Let me be a contrarian and attempt to refute @user34804's answer $48$ to question three (how many days max without thief knowing the correct combination, with different configurations each day). This answer seems to have stood for seven years, so probably I'm making some silly mistake or we are interpreting the question differently.
Let $G$ be a graph. Its locking number is the maximal $n$ such that for some distinct $u, v \in V$ we have $|N_1(u) \cap N_1(v)| = n$, where $N_1(w) = \{w' \in V(G) \setminus \{w\} \;|\; \{w, w'\} \in E(G)\}$ is the open neighborhood of $w$ of radius $1$. The motivation for this terminology is that if the nodes of $G$ represent the different states of a bike lock, and the edges represent moves that the bicyclist may make after locking their bike, then this $n$ is the maximal number of days that may pass before the thief knows the combination: If $N_1(u) \cap N_1(v) = n$ then we can list elements of $N_1(u) \cap N_1(v)$ for $n$ days, and the thief still does not know whether $u$ or $v$ is the right combination. If we list any $n+1$ elements of some $N_1(u)$, then by the choice of $n$ this $u$ is uniquely determined, as no other node $v$ has those $n+1$ elements in its open neighborhood.
In the question, the graph has nodes $\mathbb{Z}_{10}^4$ and edges are $\{u, u+v\}$ where
$$ v \in \{aa00, 0aa0, 00aa, aaa0, 0aaa, aaaa \;|\; a \in \mathbb{Z}_{10} \setminus \{0\}\}. $$
There's a lot of symmetry, so it is possible (though tedious), to verify that the maximal intersection satisfies $|N_1(u) \cap N_1(v)| = 14$, attained for example by the pair $u = 0000, v = 9000$, for which the intersection is
$$ \{1000, 2000, 3000, 4000, 5000, 6000, 7000, 8000, 0100, 0110, 0111, 9900, 9990, 9999 \}. $$
So the locking number for this graph is $14$, and thus it is on day $15$ that the thief can finally be sure to open the lock with just one move. (This thief seems to be even lazier than the bicyclist.)
I don't really understand @user34804's deduction, but one claim they seem to make (switching to their notation) is that if you move $a$, $(a,b)$, $(a,b,c)$ and $(a,b,c,d)$ respectively by $1$ through $8$ clicks, and the correct combination $(0,0,0,0)$, then the thief still doesn't know whether the first dial should have $0$ or $9$. But obviously they can, namely the thief knows that the correct combination is either $(0,0,0,0)$ or $(9,0,0,0)$ after the moves of the first dial. Given this information, many further moves of $(a,b)$, $(a,b,c)$ and $(a,b,c,d)$ reveal that it is $(0,0,0,0)$, for example if we rotate $(a,b)$ by $1$, we get $(1,1,0,0)$ from $(0,0,0,0)$ and there is no way to reach it from $(9,0,0,0)$.