I was searching for a solution just like the one you have suggested.
Based on your answer I have made a small mod that hides the developer options - All it does is replacing the development.xml file with one that contains a 'false' value, and setting the right permissions. I tested it on my Samsung Galaxy S4 GT-I9500 and it work perfectly.
If anyone want to use the mod, it can be downloaded from here
- flash it with CWM/TWRP etc.