The reason the NowTV box is locked down is because it's subsidized, and only costs 9 GBP.
I also didn't think you could side-load a pkg file, only zip. You used to be able to side-load a package file, but it was brought to Roku's attention that this would allow exactly what you're trying to avoid (breaking into the debugger and viewing the code), so they disabled it. I hope they haven't re-enabled it (for various reasons, not the least of which is the ability to provide a client with a package, without allowing them access to the source). The point, of course, being that you'd have to give them a zip file anyway, which renders the original concern moot.
My Channels: http://roku.permanence.com - Twitter: @TheEndlessDev
Instant Watch Browser (NetflixIWB), Aquarium Screensaver (AQUARIUM), Clever Clocks Screensaver (CLEVERCLOCKS), iTunes Podcasts (ITPC), My Channels (MYCHANNELS)