Comment by moregrist

One solution is to encrypt the firmware and keep the decryption keys on the hardware side, preferably in something that’s tamper resistant.

It’s not ideal. It has serious drawbacks. It makes development and updates a PITA. But it does make it much harder to decompile your firmware.