How exactly does it work, do they have to be active and bonded? just bonded? or just worn? I'm trying to figure out how vulnerable a non-magic char would be if they had an inactive foci on them, or a bonded lock on them.

How do they work? The magician or adept buys one or steals one. He spends Karma to bond it. If its a Sustaining Focus then he picks a spell for it to sustain at the time of bonding. Once bonded, the awakened character can turn it on or off by touching it and using an action. Activate Focus is a Simple Action. Deactivate Focus is a Free Action. (SR3 page 105)

A Sustaining Focus is placed on the person who is receiving the spell, and the spell is cast on that person while the magician is still touching the focus. It'll stay active till it is removed from the person or the magician touches it again to Deactive it. The spell can also be dispelled, and the focus can also be attacked/destroyed. That's it.

Foci can not be attacked from astral space unless they are active (turned on). In our game we play that a non-magic character has no way to hide an active focus from the astral plane (some GMs might allow you to hide it inside your clothes or a body cavity). Foci on mundane characters works best if the magician who bonded them is nearby to protect them from astral attacks. The lower the force of a focus, the easier it is to destroy it from astral space.

The only focus I know of that is self-protecting is a sustaining focus with astral barrier.

I heard or read somewhere that someone can potentially be hurt from the astral by someone pumping a spell through the focus/lock or something similar and using that as a bridge to the physical world.

You can also add extra Karma when bonding a focus to give it extra dice to defend itself with. I' don't have the book in front of me to know if there is a limit, but that could keep them from getting fried. Best defense, use a Free action, which you can take on anybody's phase to deactivate the focus if you feel it could be threatened. It doesn't help if the Astral mage strikes first and stages the Damage to deadly w/ a spell, but it could help if you have foreknowledge of the impending attack.

Hey Grift, they killed that rule in 3rd edition. It was mega Twinkie.

Spell locks are from second edition. They no longer exist in SR3 other than at the GM's discretion. Grounding is also second edition, so again GM discretion.