Lets post couple more corrections:

1. You can activete security code with custom kernel, but you need a custom devicelockd for it.

2. You can recover & read devicelock code in cleartext if
a) you have setup trusted person
or
b) use exploited capabilities and custom devicelockd for reading it from aegis secure storage.