It would be more of a deterrent if they would have only allowed writing the sitecode via the programmer, and only then if it was blank. So basically, the locks

It would be more of a deterrent if they would have only allowed writing the sitecode via the programmer, and only then if it was blank. So basically, the locks ship with blank sitecodes, the programmer can set them once (other code on the lock would handle writing the sitecode to nvram, inaccessible to the programmer's read "command"). After that the only way to change the code is to reset the nvram. This way the sitecode wouldn't be readable from the programmer, and a malicious programmer couldn't set a sitecode that they provided. The requirement of resetting nvram would be enough to mitigate most attacks, especially if you could only make it accessible from the other side of the lock.