Floating gate flash is susceptible to X-ray, but you risk damaging the onboard charge pump if you subject the device to sufficient energy to guarantee erasure of all bits (the only way to guarantee that you have erased the security bits).
It is possible to erase memory cells at certain energy levels that will not significantly damage the cells, but the exact level is not really known and varies with process and unfortunately that energy level is what fries the onboard programming charge pump.
Floating gate device memory cells are particularly sensitive to energy levels in the < 9keV range; see this and this application notes from Spansion (originally from AMD).
It is possible to make X-ray sources in this range, but probably not cheaply, and this risks damaging the memory cells such that they are not recoverable.
I have had ordinary post-solder X-ray (tungsten source, very little energy below 40keV) flip bits from programmed to de-programmed, but it is somewhat rare.
That same source, when turned up to around 140keV, fried the charge pump and some of the flash memory cells in a power sequencer (flash based programme).
The short answer is that yes, flash can be deprogrammed by X-ray, but with no guarantee of the operation of the device if you successsfully get the device de-programmed and just what energy level for a given part is very unlikely to be known.
The erase event is quite simple (according to research available in IEEEXplore):
The floating gate is programmed by tunneling electrons across the tunnel oxide between the control and floating gates.
X-ray is simply high energy photons that produce electron-hole pairs on the floating gate - as electrons have a higher energy level than holes, more electrons than holes migrate, resulting in a net loss of electrons on the floating gate when the event ends and recombination takes place; whether this is sufficient to de-programme the cell is device dependent.