It's a security thing - by default I leave the Pucks open to make it easy for developers to get started, but allowing anybody to remotely change the interpreter software would be a recipe for disaster.
The bootloader is protected by a key, but because Espruino is Open Source and people want to be able to use their own firmware the key is public - so anybody can write whatever they want onto their Pucks.
Espruino is a JavaScript interpreter for low-power Microcontrollers. This site is both a support community for Espruino and a place to share what you are working on.
You need to have physical access to the Puck to put it in to bootloader mode - to do the steps shown here: http://www.espruino.com/Puck.js#firmware-updates
It's a security thing - by default I leave the Pucks open to make it easy for developers to get started, but allowing anybody to remotely change the interpreter software would be a recipe for disaster.
The bootloader is protected by a key, but because Espruino is Open Source and people want to be able to use their own firmware the key is public - so anybody can write whatever they want onto their Pucks.