JTAG is pretty much only to test physical pins in production, everything else it does is just vendor extensions on top.

Most chips allow you to disable JTAG completely or prevent reading out the program, only erase it.