The big benefit of a configuration file, be it xml, json, ini, is that it separates data from behavior. This can help keep it readable. You can do this with code as well. Yourwell; you're just not forced to do it.
If you'd prefer to stick with configuration files, a way to meet your need to secure your configuration would be to compile your configuration in some way. This could be anything from obfuscating to encrypting to zipping and password protecting. None will be perfectly secure,secure; neither is code, but should keep the casual user from fiddling with settings.
Configuring in code can be kept simple, but requires discipline. Construction or creational patterns can be leveraged for this. If you have the time to write one you could go as far as creating a DSL (Domain Specific Language) builder.