>Many devices in the Microchip (ATMEL) SAM Family make use of GPNVM bits

Only in the SAM(single letter)(rest of part number) and SAME/V/S70 family.

They went out of their way to maintain legacy parity with the M7 cores against the older M4 cores (which have GPNVM) for some reason I forget when I was discussing those chips with them in pre-production sampling long ago.

I wouldn't call this a zero-day per say. If I have your chip, programmed, physically in my hands. I will nitric acid the sucker and throw it under an electron scanning microscope to laser the security bits off if I want your firmware. I've done it before.