I don’t see any guide talking about that. I would try some kind of Htaccess to prevent people from using /setup.
It feels like a bandaid, but on the other hand I have never seen a “server application” where URLs like /setup can selfdestruct after one use.