Is protected flash secure?

What resources do they have available? How motivated are they to attempt outright theft vs. just being a "copycat" (at some other level)?

Exactly. Virtually every "protection scheme" can be beat; the question is where you draw the line between practical vs. impractical for a given attack vector.

Is it cheaper for me to try to break your ("hardware") protection? Bribe one of your employees? Reimplement your design from black-box observations of its behavior/specifications?

If you are truly interested in the types of attacks that can be mounted on your hardware with MINIMAL access to the device's internals, there are lots of papers on the subject. (E.g., dynamically monitoring power supply current to deduce the instructions that are being executed)

A typical MCU won't have serious protection but some security processors will, including ones that aren't very expensive because they're intended for use in high-volume applications like payment cards. A very determined and high-resource attacker will be hard to stop, especially if they can get their hands on lots of individual units. But you can make it pretty hard. Today's smart cards evolved over a many-year technical arms race between cable TV companies and cable pirates. These days the smart card manufacturers seem to have the upper hand, though maybe the advantage will flip again some day.

The book "Security Engineering" by Ross Anderson is now somewhat dated, but it's good reading about this type of subject.

Pretty much. Though the costs can go a lot, lot higher than that.

My advice would be to pick something in as small a technology as possible. It doesn't prevent attacks, but ratchets up the difficulty level substantially, at least for physical attacks. It also reduces SNR for sidechannel attacks, though some features of more complex processors (eg caches) can increase the potential sidechannels.

The other option is to go for hardened processors (eg as used on smartcards) which have additional mechanisms to prevent physical attacks - but those are mostly focused on protecting key material rather than software.

But, generally, making it not worth their while is the safest defence.

Theo