Theoretically you could attach to a process with LLDB, and use objc swizzling to intercept calls to NSUserDefaults. However to do this, I think you would need to disable SIP. Even then i'm not sure this would work.

In practice, people probably just read user defaults and try to reverse engineer what they do.