Bounded projects inherit permissions from the container so users with edit access to the spreadsheet will have edit access to the code in the bounded project.

One alternative to protect the code is to move to a library.
Another alternative is to create an add-on.

<hr>
**References**  
[
Collaborating with Other Developers - Google Apps Script](https://developers.google.com/apps-script/collaborating)