Another good trick is to replace the crystal with a bit stream.

If you can identify the cycle where the security bits are being read you can insert a runt pulse that is much faster than the norflash read time.