and especially: http://web.engr.oregonstate.edu/~traylor/ece473/lectures/fuses.pdf
It may be possible to set a "Mode not 2" aka "Mode 1 xor 2", with LB1 as 1 and LB2 as 0.
an enterprising individual should be able to use the programming ability implicit by LB1's enabled status to reset LB2 to 1
irregardless, by "clamping" (wire tapping) the flashing data stream, (presumably over a USB cable) the uploaded data can be seen (trivially and literally with an oscilloscope - a person "could read" RS232 data this way for low (<<75) baud rates and is the visual analogue to the aural ability for using Morse code, where senders could even be identified by their "fist")
if this uploaded data is therefore NOT decrypted before flashing then the internal boot loader must be modified to decrypt it, ... and if parts of the boot loader must be decrypted by a key encrypted in the flash upload data ...
a secret external key, password, starts the process above, so a "cold" chip is useless otherwise
this technique does not prevent copying but it does inhibit usability of the copy
if nothing else, the obfuscation presents a challenge for not only the interloper but the authentic author too