Modern PLCs can be programmed over ethernet. Some such as Allen Bradley Control Logix have a physical key switch on the front which allows the PLC to be put in run/program/remote mode so it could be locked to run mode which would prevent remote changing of the mode and not allow the program to be modified.

I've never worked with Siemens PLCs apart from a demo from the distributor and the schneider PLCs I work with don't have the physical run/program switch.