If people are willing to go to these measures to steal Intel microprocessors, which are generally available, imagine what people will do in order to steal unprogrammed Skipjack chips. In the volume the Government would like to see them made, the physical security which one might want to give to a classified production facility will be difficult or impossible.
They thought of this. The Skipjack algorithm is programmed into the chip at the same time the escrowed keys are. If you steal the unprogrammed chips you may learn the list of basic operations that are part of Skipjack. However there are also basic operations implemented on the chip which are *not* part of Skipjack but are there just to confuse someone who would disassemble a chip. Btw. This also means that the actual chip assembly line does not require cleared workers.