If you want, you can take a look at my /sbin/preinit press-any-key-to-get-shell mod.

Uhhh, I believe it was in the Recovery Shell thread by Pali, a few pages in. I can link to it if people can't find it and say so.

But I THINK you could modify that general concept to give you a terminal-like prompt on the N900 for a password before proceeding. Since /sbin/preinit is effectively the first thing that runs, any time the device turns on, including when it detects being plugged in for charging or USB storage while off, you should be able to at least 'block' a person at that level (though I've noticed the "shutdown" command doesn't work within that shell as I have it installed, so you can't force a device 'off'). What you can also do is modify /sbin/preinit to simply make it ignore the booting 'fork' that it takes for USB storage mode. Instead, where /sbin/preinit has the "case" syntax where it compares the bootstate and then does different things from there, you can just alter the section for bootstate being the charging/usb storage to be identical to the normal boot - that should prevent if from exposing the internal storage to USB until the device has booted up properly, including lock code and/or SIM code.

I've never tried either or these methods, but my educated guess from memory (haven't opened /sbin/preinit in a month or two, was reverse engineering an open source version but collegiate education has left me with no time for that currently).