Maybe some of the newer stuff is better, but you're kind of overselling the hardware protection (lol). I'm sure everyone thought RDP1 on the STM32F1xx series was going to stop "bad guys" (or even RDP2, lol) but I was able to do better than Obermaier on firmware recovery of a F103 recently without going to the trouble of doing something like delidding a chip or even undersoldering it. The newer stuff is a little better, but a quarter in the Deepseek machine, some fairly common tools and patience, and even skids will be breaking into your invulnerable firmware fortress. I think the apocalyptic nature of all this just hasn't really sunk in for a lot of EEs or firmware developers.

RDP2 is barely any more secure than RDP1. When the processor boots, it reads the read-out protection value from flash. If it's one specific value, it's RDP2, if it's another specific value, it's RDP0, and if it's any other value, it's RDP1. This means that all you have to do to downgrade the chip to RDP1 is glitch it while it's reading that value, then you can use one of the RDP1 errata to read out the flash.

In general read-out protection only prevents the most casual of hobbyists from getting your firmware. Anyone who thought otherwise even pre-AI doesn't know what they're doing. It's sort of like how blu-ray copy protection only prevents people who don't know about MakeMKV from copying their discs, or how HDCP only prevents people who can't find a $20 HDCP terminating HDMI splitter from capturing the protected video.