I believe the point being made is that provisioning is supposed to be all about providing a secure client to protect the server and content. If the device in question is inherantly designed to not be locked down then there is a huge whole in the arguement.