Even if you lock everything now, what if the thing autoupdates with new helpful "features". You can't patch bad development culture.