is it possible to just directly burn the .hex file without considering the lockbit and fusebit settings? or do they have to be set?
They have to be set, if they're not already set to an appropriate value.
ISP programming requires a "chip erase" as part of the process, which resets the lock bits to their default state. This may be OK, or ... not. The fuse bits stay, so if they are right they do not need to be changed, but they will almost certainly need to be changed at least once if you are starting with a bare brand-new chip, mainly to get the clock options set correctly (IIRC, the default settings cause a 1MHz internal clock.)
There are some "fuse byte" calculators out there, but it's not obvious that they're "easy to use" if you don't already know enough to set the fuses without one...
Note that directly burning the .hex file requires a specialized "programmer" piece of hardware, like Adafruit's USBtinyISP