Since the templates are not read directly, you can deny access to any .tpl file using .htaccess.