Yeah reading them from inside an emoji is trivial, so that is probably the case. There is a way to lock cashu token so they can only be opened by a specific npub, that's the only solution really.