Yes you can! Like your other syncjobs, setup a new syncjob which requires the remotestate be ‘asterisk running’, localstate as ‘asterisk stopped’. Then set the syncjob to sync a single file:
/tmp/secast.state
Your tertiary PBX will always pull the latest security data from the active PBX. And if the tertiary promotes, there is no risk overwriting the local security data because of the localstate requirement.