I recently had to look into firmware readout and write protection for the STM32. And I noticed the process of disabling write protection after it's been enabled, is not device-specific; there's nothing unique (like the 96-bit device ID) involved in the lock/unlock process, that prevents someone other than the owner from unlocking the device, except that the unlocking process triggers a Mass Erase of the flash memory. The unlock keys are there in flash programming manual for anyone to see.
So did I miss something in the docs? Or is this just how it is with some MCUs, where disabling write and read protection basically results in a Mass Erase, ensuring the owner's code is safe (typically the ultimate goal, I assume)? Are there MCUs that actually use passwords from SRAM, unique device IDs or pin logic levels, to protect the flash and is this usually a built-in feature or must be implemented by the programmer?