>Program the die before packaging, and don't connect the pins necessary for
>programming.  There are lots of other things you can do...

I believe this is one of the tricks done with early one chip micros where there
was no code protection function, especially with the ROM versions of the chips,
like the 8048 series, where the read function was still available, even though
you could not write to it. When you specified the chip you specified the program
enable to not be connected to the pad.