You can't normally open the device for writing if it's mounted under
   NetBSD (you have to be running with securelevel<1, which means either
   single-user or insecure).  (This is't perfect; you can still open other
   partitions that overlap the one in question.)

   But the main question I have about this is: how does fsck get exempted
   from this?  It opens the device for writing, after all.

1) It's run with securelevel <= 0.

2) It's run with the file system mounted read-only, and it does a
MNT_RELOAD when it's finished, so it's `safe' (assuming it doesn't
crash).