Linux screen lockers are somewhat notorious for security-ish bugs like that. There's a project called XSecureLock that aims to address some of those, although I'm not sure if it fixes (or can fix) the restore-ram type bug you detailed.
When configured properly, xsecurelock does fix this type of bug. The key is to use the -l option of xss-lock, which passes a lock file descriptor to xsecurelock and waits for it to be closed before allowing the suspend.
https://github.com/google/xsecurelock