I'll try to remember to look tomorrow at the source code for the Rx2 devices. I'm pretty sure that when ENBOOT= 1, the bootrom is superior to the EA=0 for those addresses. I could be wrong since its been about 5 years since I worked on those devices at that level. As I recall the ISP full chip erase function performs a number of steps in firmware. These include erasing the user code, verifying the user code is erased, the SB and BV, and then lastly the security bits. There is a verify along each step of the way. Its possible that the SB & BV are erased first. I'm pretty certain that the SB & BV were set back to the defaults in this routine (SB = 01, BV=FC). Again, I'm trying to recall from memory (the older we get the harder that gets!).