To raise the security bar just one more notch, I've checked in code (and released new firmware) that sets the bit in CCFG_SYSIO to disable the ERASE pin early in main(). What this means is that now you must short the ERASE pin at power-up for it to be effective. Once the firmware starts to run, the ERASE pin won't work.

This isn't a huge improvement. It just makes the Vulcan neck pinch just a tiny bit trickier to apply.