From what I can find, it looks like ASML has a software brick they can just drop into the update stream. As cool as physical disabling would be, a remote software trigger is simpler and leaves the machines in tact to spin back up after aggression ends