To do that, they would have to physically connect a debugger device to it - and you have the same problems you would with any microcontroller.
One method is to simply check the chip's serial number in your code.
You can also turn on 'read-out protection' on the chip? Are you using Puck.js, or one of the other Espruino boards? The method for doing that would be different on different chips - it's off by default because it can make it more likely you'll make your chip unusable during development.
Espruino is a JavaScript interpreter for low-power Microcontrollers. This site is both a support community for Espruino and a place to share what you are working on.
To do that, they would have to physically connect a debugger device to it - and you have the same problems you would with any microcontroller.
One method is to simply check the chip's serial number in your code.
You can also turn on 'read-out protection' on the chip? Are you using Puck.js, or one of the other Espruino boards? The method for doing that would be different on different chips - it's off by default because it can make it more likely you'll make your chip unusable during development.