Don't the keys normally prevent "people with physical access to the device" from easily updating the firmware?

This includes everyone from J. Random Hacker who wants to install on thier own hardware a linux (which might or might not be a good build), and an attacker who has borrowed your device from a hotel room to put some rootkit on it.