Security bit 1 stops movc from the sector in which it is set, bit 2 stops erase and program, bit 3 makes device useless for ISP.
So with movc to use and ISP to be enabled, only bit 2 set in all sectors except the one with ISP, can be a bit of help.
There is no read option, except the way given in the post (do not know if it is true), so there is no read protection bit.