Not really, in fact I believe some methods even reboot the system into a recovery mode without any user interaction, so given a vulnerability, there are definitely ways of interacting with the phone without it being unlocked.

But do they start that process with it being locked? It's one thing to inject code while unlocked and another to take control of a locked phone.

The whole locked phone thing is just a graphical and OS feature. If the OS is vulnerable to a remote injection it might just as easily bypass the locked state.

I'm unfamiliar with the exact process of jailbreaking; if a phone is unlocked but plugged into a separate computer, you can essentially run arbitrary code on the phone if you are controlling the computer it's connected to?