[transpute]

  locked/frozen during boot
  until the drive has been power-cycled

There's a fixed time window for accepting secure erase, after power cycle?

[yrro]

I suppose arguably the kernel, or at least some component of the OS, should be freezing/locking drives as they come online. The firmware doing so as one-off operation during boot is a workaround for the lack of this being done by the OS.