The RP2354 has the flash stacked inside the chip; https://www.raspberrypi.com/news/rp2350-a4-rp2354-and-a-new-...

Still can be reflashed if you have access to the right pins, but I believe there are more security features built into the later generations of these chips (plus some security fixed from the original 2350 design).

Just to be clear, some micros (STM32s come to mind) have what they call "on the fly decryption" for external flash. Basically, if the micros wanted to, they would. I think ESP32s are also using qspi flashes but they're integrated in package? Maybe that's changed but that's how I vaguely remember it

I use a RP2040 in a commercial product, but it's for a niche portion of a niche industry and it's not intended to ever communicate with another device. Disabling USB mass storage and not adding a bootloader button is good enough for me.