hardly anything is a bigger red flag in security than "we make our code secure by restricting access to it." most of all, the startup code in ROM.