Here is what the docs actually say:
Code:
// Flash Security Setting. On Teensy 3.2, you can lock the MK20 chip to prevent
// anyone from reading your code. The bootloader will be unable to respond to
// auto-reboot requests from Arduino. Pressing the program button will cause a
// full chip erase, because the bootloader chip is locked out. Normally, erase
// occurs when uploading begins, so if you press the Program button accidentally,
// simply power cycling will run your program again. When security is locked,
// any Program button press causes immediate full erase. To set the security
// lock, change this to 0xDC. Teensy 3.0 and 3.1 do not support security lock.
I believe your description "the teensy loader cannot force a reboot" are the same as "The bootloader will be unable to respond to auto-reboot requests from Arduino".
Actually, it does erase the chip when you press the button. Then moments later the upload programs the blank chip with your code.
Normally, the erase happens when Teensy Loader sends the first piece of data. This may seem like a minor unimportant detail, and indeed is makes no practical difference for when you're just uploading programs. Either way, the chip gets erased shortly before your new code is written.
To see why this is important, you must test differently. Upload a program that does something you can easily observe. The LED blink example is perfectly fine. Close Arduino and Teensy Loader. Watch the Teensy to make sure it's running the program. Then press the button "accidentally". Imagine Teensy is running from a power supply or a computer without Arduino and your code. Because this was an accidental button press, unplug and reconnect Teensy to the USB cable. If the chip was locked, you'll see no blinking when you plug the cable back in, because your Teensy is now blank due to the button press. If the chip wasn't locked, Teensy will run the previously programmed code when you plug the cable back in, because the button press does not normally erase Teensy's memory.
I tried to explain this in the docs, but perhaps it's not clear? Please try this with your Teensy, and imagine the scenario where you've installed Teensy into some application and an end user it able to accidentally press the button.
When you're using FSEC to lock the chip, you need to be careful about the button. It must not be pressed accidentally (when you do not wish to reprogram), and it must be pressed to initiate the upload.
Everything you've described is the expected behavior.
No, changing FSEC this way does not prevent reprogramming. But you must press the button.
How could I edit the docs to make this clearer?