I don't know much about the lock bits on other derivatives but on a SiLabs chip I would use a block cipher for the encryption/decryption and hardcode the key in the bootloader. The bootloader can be protected by locking out the reading of its code memory (FLACL) but can still program the application. The whole chip can be locked out from reading through its JTAG interface. But how good/reliable these lockout mechanisms are I do not know.