Any bootloader can program the pic even if code protection is turned on... it is just access to the code area with a programmer that code protection protects from. Not from inside the PIC.

BUT since you download the HEX file from internet it better be a loader with encryption or the code is public anyway :-)