I know what this is like
I know this is an old post, but I'll post my thoughts anyway.
I agree with the OP.
This happens in our plant 6-10 times per year. (Not counting the rare times when the PLC actually loses the program). As the OP says, this is maintenance hitting the wrong button).
Rockwell is mostly to blame, because the dialog doesn't say "download to PLC". This is not universal wording, you know. Sometimes download means from the PLC.
This to me makes the "training" suggestion a joke, as well.
The help file does clear that up, but we can't seem to expect maint to slow down enough to read that, which also is my answer to "they should notice the Program Mode warning".
I am greatly amused by Ken Roach's suggestion to leave the key in Run - for the main reason, that screws me from being able to work on it remotely, and for another they will just put it back to Run Remote. Yeah, maybe that will slow them down enough...
Sorry, I had to vent. And I haven't yet explored the security options, we don't do anything like that yet.
I can probably publish a notice in the maintenance area that might drill it into their heads.