My thought behind having one made without programmable ui is I'm worried it could be switched or enter a programing mode when I don't want it to. I would be wearing this on my belt in a bezel down holster an it could be accidentally switched. I guess I could run a shrouded tailcap to prevent any accidental presses.
Simple and less complicated firmware with High/Low is possible, yes and it does provide ease of mind that you don't have to worry about accidentally entering programming mode... In theory it is possible to engage programming mode but in practice, it requires 8 fast taps to enter blinking (which serves as cell monitor at the same time, showing approx voltage left in cell under load - thus giving approx capacity left)...
But even then I'd recommend 3-modes, especially as you're going with High/Med/Low... consider it Turbo/High/Low as Turbo is up to 2 minutes runtime (depending on host/bezel), Medium and Low modes that are safe to use until cell depleted...
Shrouded tailcap is one way to go... the reason why I love Surefire tailcaps is anodization on threads so when used with any P60 body it provides lock-out feat, unscrew tailcap just a bit and you're safe that there will be no accidental activation - I recommend doing lock-out with all hot-rodded Surefires of mine...