I use a RP2040 in a commercial product, but it's for a niche portion of a niche industry and it's not intended to ever communicate with another device. Disabling USB mass storage and not adding a bootloader button is good enough for me.