It's the same for html5 web exports, they just have to know where to look.
In fact all someone needs to show your game somewhere else is to know where the index file is.
Its up to the host to block that kind of thing, which of course may also limit the games functionality.
Its up to you to sitelock your games, and of course they don't provide that information readily.
Not sure htf you're supposed to do that with nwjs.