Is oor:finalize="ture" broken?

[cjbayliss]

I am a sysadmin in charge of computer kiosks and my users are hostile.
I want to disable some functionality (e.g. VBA/macros, etc).
I want to guarantee users can’t turn it back on again.

With the following code:

<?xml version="1.0" encoding="UTF-8" ?>
<-- ... --!>
<oor:component-data oor:name="Calc" oor:package="org.openoffice.Office">
  <node oor:name="Filter">
    <node oor:name="Import">
      <node oor:name="VBA">
        <prop oor:name="Executable" oor:op="fuse" oor:finalized="true"><value>false</value></prop>
        <prop oor:name="Load"       oor:op="fuse" oor:finalized="true"><value>false</value></prop>
        <prop oor:name="Save"       oor:op="fuse" oor:finalized="true"><value>false</value></prop>
      </node>
    </node>
  </node>
</oor:component-data>
<oor:component-data oor:name="Writer" oor:package="org.openoffice.Office">
  <node oor:name="Filter">
    <node oor:name="Import">
      <node oor:name="VBA">
        <prop oor:name="Executable" oor:op="fuse" oor:finalized="true"><value>false</value></prop>
        <prop oor:name="Load"       oor:op="fuse" oor:finalized="true"><value>false</value></prop>
        <prop oor:name="Save"       oor:op="fuse" oor:finalized="true"><value>false</value></prop>
      </node>
    </node>
  </node>
</oor:component-data>
<oor:component-data oor:name="Impress" oor:package="org.openoffice.Office">
  <node oor:name="Filter">
    <node oor:name="Import">
      <node oor:name="VBA">
        <prop oor:name="Executable" oor:op="fuse" oor:finalized="true"><value>false</value></prop>
        <prop oor:name="Load"       oor:op="fuse" oor:finalized="true"><value>false</value></prop>
        <prop oor:name="Save"       oor:op="fuse" oor:finalized="true"><value>false</value></prop>
      </node>
    </node>
  </node>
</oor:component-data>

VBA does not work default, but users can simply go into Tools > Options and turn it back on again and it will stay on until they restart LibreOffice.

I expected the option in Tools > Options to be greyed out or hidden, similar to the behaviour I see with:

org.openoffice.Office.Common/Security/EnableExpertConfiguration=false.

Am I using oor:finalized="true" wrong?
Is this a bug?

I am using LibreOffice version 4.3.3