How do I disable external storage interfaces?

Reading the note it looks like you can re-enable external storage from the external storage interfaces. This doesn't make sense. I was excited to see that you can disable external storage devices because we are looking for ways to physically lock down these devices, (e.g we don't want someone to walk up to the device and put usb stick in the device with an autorun file to reconfigure/run a malicious script on it) but if you can re-enable it from the storage interfaces externally it really defeats the purpose. I would expect re-enabling to only work by putting the enable-autorun.brs on the internal storage. What is the expected behavior here?