True, Autocad may read the attributes from the assembly and add the commands regardless of how they are used as they are still attributes open to inspection with reflection.
Perhaps the flag thing could still work if you load all the commands but do not run them if not 'approved' say -
[CommandMethod("test")]
static void MyTest()
{
if(!m_testCommand)// private bool set on loading app
{
ed.WriteMessage("Unknown Command \"TEST\""); //looks like acad
return;
}
.....
}