Hi,
Sounds very odd!
If you enter the wrong security bytes, you would get 0xAD (or whatever) in all positions, so that does not seem to be the case.
So it seems to be the correct Flash EPROM content.
In that case, try another HC908AP16, and check if it behaves the same.
Regards,
Ake