Well, I'm the kind of useful idiot rr.pub needs, so I took one for the team, using the sill button/ open window method to get to engine disabled. v37/ GEMS.
First off I did it with EKA enabled, just to be sure when I disable the engine I could get back with a. the Fob, and b. the EKA code, and yes, all fine - dash message "engine disabled enter the EKA or press the remote". Since I hadn't gone battery flat then the fob signal didn't need synching. I tried to change the EKA to "disabled" in the BeCM while the engine was disabled, but it didn't accept the change in that state.
Then I disabled EKA, wrote settings, came out and went back in again - EKA disabled. Locked the door with the fob, opened with the sill button. Turned the ignition on, this time "engine disabled, press the remote". BUT, when I went into the BECM at this point the EKA option is marked "enabled". After entering the EKA code, and going into BeCM/ Alarm the EKA setting had now reverted to "Disabled". So it appears that the BeCM always leaves the backdoor open for EKA entry, even if the EKA option has supposedly been disabled, and it doesn't actually ask for the EKA on the dash.
And as a supplement to test the key blade only theory... with EKA enabled, simulated engine disabled, the key in the door unlocks only the driver's door, and does nothing to cancel the engine disabled message on the dash - as expected then. With EKA disabled - the key in the door opens all 4 doors, and does actually cancel the engine disabled state, and the car drives away...
So it looks as if you CAN disable EKA in the BeCM, but still be able to enter the EKA (even if not asked for) - but allowing the key in the door as an extra option to getting going. The only difference with a flat battery is that the remote most likely is out of synch too - but that gives you EKA and key in the door as recovery options still.
Interested to see if others get to the same conclusion