Comment by thesnide

for such security devices, there is OTP.

I prefer to have my auth device bricked than compromised.

for anything else, i want to be able to reprogram.

so for vendors, a simple choice :

* be OTP, but no "patching"

* be R/W, but also by its owner