One of the best ways to prevent loss of industrial and national defense secrets is simply not to talk about them. A hostile government cannot reverse engineer what it doesn’t know about. Therefore it’s critical to keep the number of people involved or know about a project to a minimum. Information sharing is limited to a need to know only basis, even to those who possess higher levels of security clearance higher than that required. During the “black” days of the F-117 program, even the base secretaries had to hold at least a secret clearance, but had no idea the jet existed until it was declassified, simply because they didn’t have the need to know.
Quite often advanced R&D programs are located deep within pre-existing buildings used for commonly known programs of little significance, where foot and auto traffic are are indistinguishable. So too, are classified infrastructure systems like computer servers and storage areas for classified engineering archives out of sight and out of mind.
But as G. Gordon Liddy once said, the only way three people can keep a secret is if two of them are dead. Security slips do happen, either by accident or intentionally. Limiting who knows what is an effective way to contain damage from a breach. And the more you know the tighter the background checks and scrutiny of your life is prior to even granting you a clearance. And things get hushed up. Again during the stealth fighter program a shop worker on the floor became so enamored with a young lady outside of the company that he brought her plans of the jet to impress her. The woman had the peace of mind to contact Lockheed, who merely fired the employee as opposed to pursuing criminal charges (I would have loved to have been a fly on the wall to hear the conversation between that poor guy and the FBI agents doing the exit interview!)
Specialized sites which deal specifically in “black” ie highly classified, compartmentalized programs are rare, but usually located in remote and inhospitable areas away from prying eyes. They operate on specific schedules when spy satellites are not overflying and often in the dead of night to limit viewing.
UPDATE
In regards to capture and reverse engineering an aircraft by a hostile government, if the other side can get hold of an airplane intact and unharmed, there’s no reason they cannot carefully disassemble and reverse engineer the thing. This has happened on multiple occasions - soviets captured intact B29 and Rolls Royce Nene engines to reverse engineer into copies like the Tupolev TU-4 and Kilmov VK-1 respectively. Sensitive tactical aircraft which are damaged and unflyable can be destroyed to prevent capture, as was the case of the as yet unidentified stealth helicopters used in the raid that killed Osama Bin Laden in 2011.
The biggest risks are in the form of aircraft sold or built under export licenses to foreign nations in good relations with the USA and its western allies which may also be open to selling the aircraft with nations hostile to the US and the west. This can be done in the form of export and license production agreements between the United States and a country as part of an arms deal which prohibits sales of certain countries. Another method is downgrading the aircraft and onboard technology for export aircraft. This can come in the form of derated or inferior types of engines (the proposed F-16/79), inferior avionics, radars, and mission systems and even RCS size limits as seen on the F-35. This allows a nation to purchase a fighter suited to its defense needs but is inferior in capability to the same type flown by US and western armed forces.