I may be contradicted by someone else with information I'm not aware of, but I believe that because the map data services are accessed by a URL, anyone who loads your map into a browser can look at the communication stream to find the URL and then have access to your service. When you create your services, about all you can do is make sure to reduce the amount of information exposed, e.g., by turning off fields in a data layer.