Beano...There are five layers that make up the ZigBee stack. The 'security layer' is fully encrypted for extra security. It is my understanding that a person cannot "set up" ZigBee devices over the air unless it matches the security layer code.
Of course, I didn't "personally call" anyone to confirm this so perhaps YOU should do your own DD to verify if I'm correct.