Through legal agreements.
You can’t really stop this through technical means; the developers needs access to the source code, and need to understand it.
Someone who understands source code can find vulnerabilities in it. Someone who has wide-level access to source code can copy it. That’s why you have legal agreements; you get hired to work, and in exchange for the salary you’ll agree that you have no rights to the code, and that vulnerabilities shall be disclosed internally; not abused.
If you break it, you’ll find yourself a likely target of a lawsuit.
Digital files cannot be made uncopyable, any more than water can be made not wet.
— Bruce Schneier (and probably others)