How do I prevent a controller from creating unwanted routes?
After too much time spent on this, I think I found a solution to both issues.

1) To prevent controller actions meant for the CP from being accessible on the front-end (via actions/&lt;module&gt;/&lt;controller&gt;/&lt;action&gt; URLs), simply add this line of code at the top of the action's method:

$this-&gt;requireCpRequest();


The non-CP action URLs will now return a 400 error.

2) Although it doesn't seem possible to change the private template trigger on the CP to prevent any template from being directly accessed with a URL, using an underscore at the beginning of any file or folder in the path works. But even better -- the template root itself can be private:

// Set the base CP template directory
Event::on(
    View::class,
    View::EVENT_REGISTER_CP_TEMPLATE_ROOTS,
    function(craft\events\RegisterTemplateRootsEvent $event) {
        $event-&gt;roots['_module'] = $this-&gt;getBasePath() . DIRECTORY_SEPARATOR . 'templates';
    }
);


Notice the underscore in front of _module. This ensures that the module's templates will only render programmatically.