Yes it can. The code protect bit of the configuration register has to be set when the boot loader is programmed - it can't be set latter. You have to be careful that the boot loader that you use does not have the ability to read the programmed code or it can be read that way.