Securely locking down the device plays off against being able to update it. Ideally you want to disable JTAG/SWD interfaces and make them difficult to access. This of course does not protect you from people with physical access to your device, and th