ide\tools\avr\bin\avrdude -C ide\tools\avr\etc\avrdude.conf -p atmega328 -P com1 -b 19200 -c stk500v1 -v -u -U lock:w:0x00:m
this can only be changed for bootloaders with an application usable API to use the flash self programming feature. There are none currently available.
Looks like if you lock the flash from being verified (read) then you can only recover with a chip erase (which of course discards the flash memory).
If you also disable SPI programming then you would need the high-voltage programmer (eg. AVR Dragon) to recover.