If someone has your data, no matter what the format, they can do anything with it. Eg, someone can pull the PNG or JSON files from your app and do whatever they want. Spine can import the exported JSON and binary skeleton and animation files, so yes someone could modify your animations. If you are worried you might do a checksum and obfuscate your data, but there is no protection. If there were some way to protect software, it wouldn't be possible to steal Microsoft, Adobe, etc software. 🙂