I think that's what program_pubkey[1] is preventing. While you could still flash other EEPROMs, their then mandatory public key would not match the hash written to the OTP.

[1] https://www.raspberrypi.com/documentation/computers/raspberr...