Steve: Yes, you can't make changes to the settings without the password. But you CAN turn devices on and off. And, if you leave a sniffer running, you'll see packets if/when you victim ever runs UPStart and they will contain the password. Or you could periodically send an active probe for devices in setup mode and hope to catch one when the victim adds or changes links.
But, with UPB, you can SEE if somebody is trying to mess with you. If your neighbor gets UPB toys and has evil inclinations and your lights or appliances start turning on/off, you'll be able to see it happening in your log files. And you'll be able to mess with them back and see who's lights are blinking, thus identifying the culprit.
With Insteon however, you won't be able to see anything of the sort. You used to be able to see that "something" (of which the details were scrubbed out) got sent over the wire that isn't registered with you, but not any longer. It used to send a message to the host computer saying to the effect of "I saw a packet I dont recognise". Now it is utterly silent. And the good part is that Insteon switches will respond to your evil neighbor when he scans device space. And there is nothing you can do to stop it, no way to identify the culprit, and no way to even tell the difference between a device malfunction and an evil neighbor. You can't even tell if somebody is doing a scan on you.