The NVMCTRL is a split-secure APB module, all registers are available in the secure alias and only a subset of registers is available in the non-secure alias with limited access.
When NONSEC.WRITE is read zero, all APB write accesses to the non-secure APB alias and all non-secure AHB write accesses to the Page Buffer are discarded. The latter returns a hardfault. Any attempt to change the configuration via the non-secure alias is silently ignored.
Debug Access to the bus system can be restricted to allow only accesses to non-secure regions or reject all accesses. See the section on the NVMCTRL Debugger Access Level for details.