Any ESP32, RP2040 or RP2350 board. The last two use external QSPI flash, so hobby projects only. There are no fuses to set to read protect the firmware.
Still can be reflashed if you have access to the right pins, but I believe there are more security features built into the later generations of these chips (plus some security fixed from the original 2350 design).
Just to be clear, some micros (STM32s come to mind) have what they call "on the fly decryption" for external flash. Basically, if the micros wanted to, they would. I think ESP32s are also using qspi flashes but they're integrated in package? Maybe that's changed but that's how I vaguely remember it
I believe only the ESP32 modules with 16M have QSPI flash, the 4M standard flash is on chip. For on the fly decryption you need on chip enclaves to store the keys. Anyway, it doesn't really matter for hobby projects and the ESP32 can also be used for commercial projects.
Indeed, the number of "non commercial" projects using these chips that are set up much less securely than even modest "hobbyist" projects boggles the mind.
I use a RP2040 in a commercial product, but it's for a niche portion of a niche industry and it's not intended to ever communicate with another device. Disabling USB mass storage and not adding a bootloader button is good enough for me.
