I had always thought that I would want to secure the parameter data somehow, probably by saving a hash string along or inside the json file (I'm a fan of json at the moment), so I hadn't really considered granting people easy access to the package.nw files. By limiting what the player can change it prevents a player from creating impossibly immortal enemies etc. So mod-ing would be limited to graphics (sprite and tilemap images) and to the configuration of the layout tilemap as well, all supported from within the game.
I'll have to think about other sorts of mod-ing (opening the package.nw and changing assets directly) - I don't think I would mind but I wouldn't try to make it easier than it is already.
well, you could always have the game check the XML file.. if it was modded by the player, then your game would not give achievements or other "successes" or reveal level-design architecture that you've created. i.e. if your game had an "ending". It would have to be it's own game mode, you don't want to the player to be able to cheat. I guess it highly depends on the game you are making though.