If yarn.lock is updated as part of running yarn it means that the yarn.lock file wasn't in sync with the content of package.json. This should be flagged as an error and the PR blocked form being merged.

It probably means that the author forgot to commit changes to yarn.lock or introduced a bug in the file when editing it manually.