All register writes to the protection unit must be done by a secure bus transaction as defined by TrustZone.
Once the XMPU LOCK [RegWrDis] register bit is set, access to the XMPU registers is disabled and can no longer be written to until after a POR reset. The only exception, secure transaction can write to the interrupt status register, ISR.
Note: Regardless of the LOCK [RegWrDis] setting, the status registers are always writable by secure and non-secure transactions. All XMPU registers are only write-able by a secure transaction. The registers are readable by secure or non-secure transactions.