Hello Andrew.
I've tried this but it doesn't work.
I found in datasheet the support e-mail of phillips
and send them the same question.
The answer (they answer extremely fast) was:
"Philips Semiconductors answer:
Your assumtions are correct. I think you can get around the security bit for re-programming if you do your own bootloader using the IAP calls. Otherwise, ISP is not possible with the security bit set."

If does not exist some special reason (in hardware)
that it prohibits us to unset the security bit via ISP
then ...it is strange.

Regards
Lambros Sirivlis