实际上，虽然必须能够打开 USB Debug ，以便运行
I wonder whether there is a way to prevent someone to use
fastboot to flash an Android device.
Indeed, while one must be able to turn on USB debug in order to run
adb, the bootloader does not offer any protection AFAIK.
You may only make
oem lock, but if anybody really need to flash something - he can do unlock again (with removing anything from device).
And one old rule: if anybody has physical access to device - software protection will not help.