Won't this leave the the device modes in the wrong state (a possible
   security problem).  It seems to me that the correct fix would keep
   the device open so that the fchmod() could be done but in some sort of
   crippled state until it is close()ed and re-open()ed.

Absolutely not.  If the device was revoke(2)d, then you should not be able
to do *anything* to it without reopening it.  If this weren't the case,
the system call would be useless, since it exists to enforce security.