Just to clarify Apple is the only one that can actually unlock the phone, they usually do it once the carrier has sent them the request along with the phone's IMEI. The firmware is different for Verizon and Sprint devices, it’s preloaded with Verizon’s or Sprint’s MMSS file which can’t be updated over the air on the 4S The MMSS file is one of the things that tells the device to prefer CDMA over GSM when it goes through network acquisition
To use an AT&T 4S on Verizon and Sprint five things would need to happen.
- AT&T would need to authorize Apple to unlock the device
- Apple would need to unlock the device
- Apple would need to load Sprint or Verizon’s MMSS file (there are a few other things as well)
- Sprint or Verizon (depending on who you choose) would need to load the MEID of the device into their network
- Sprint or Verizon would need to turn off SSD authentication once they’ve provisioned it for use
The biggest barriers to this are #3 and #5. Apple also doesn’t want to give carriers the software to flash and load firmware to their devices. (understandable). This leaves us with #5; CDMA networks have two authentication measures the first is by ESN/MEID and MDN, the second is SSD. In order for SSD authentication to happen the carrier needs know the secret key that is unique to your device, and they can only get this from the manufacture (in this case Apple) They can turn this level of authentication off for a customer, but it opens that customer up to device cloning fraud. So you can see why they don’t like to do that.
I would also add that the firmware load for Verizon and Sprint’s iPhones restricts SIM’s with US IMSI range (other than their own of course) from being used in the device. As mentioned above there is no way for Sprint or Verizon to change this on devices already produced. (Apple would have to re-flash the device)