That's the whole point of a TKey as a security device: the secret available to an application depends on both the device it's running on and the application, and can't be extracted, so you can do things like "sign a blob only if it follows these rules" and enforce it in hardware. If the device wasn't locked, you could just... change the rules.

How is that not a legitimate form of security?

If it's my device, then I should be able to change the rules.

If you can change the rules then someone else can also change the rules.

And any ability to change the rules will greatly increase the surface area of attack.

You're more than welcome to change the rules. Please read my other comments in this thread, and you'll hopefully find answers to your concerns. The TKey Unlocked gives you all the control you're asking for.

How so?

Consider a DRM system that does challenge/response against said secret so that only one computer at a time can use something. As the owner of this device, if I want to clone it, I should be able to.

You can buy an unlocked version and clone it, no?

But then the device could be used by 2 computers at once defeating the security. Another use case would be as a second factor of authentication. Making it impossible to clone is essential for a "something you own" factor.

Buy the unlocked version, program it and lock it down yourself.