I'm just wondering (seriously, this may be really dumb), but would it be possible to modify the ipl to load only the major PSP Kernel Modules, alowing the use of SCEKernelExec and thats about it. Then make it load the devhook modules, rebooting to X firmware.
This would solely mean that people would not really have access to the flash0 files because it's rebotting to a new firmware. Eliminating most danger.
(obviously there'd have to be some kind of special recovery mode)