Harden adb on Android 2.3 Actually I was never thinking about leaving my adb debugging enable on my cellphone when going outside.
Now on cyanogenmod 10 and newer, it asks me to verify the rsa key of the host, which makes really sense.  

I have a htc desire z / g2 here which doesn't ask me.
It's running Cyanogenmod 7.2 as this is the newest stable, with no gappsm with Android 2.3.  

How can I harden it? I know it can be disabled when the screen is locked, but that's not enough.
There is no way to get Gingerbread to prompt the host to verify RSA key as that is found in newer versions of Android (Jellybean 4.1 and upwards).

The only true method of hardening ADB in the sense of prevention of communicating over the USB is to modify the kernel for that appropriate device and disable the USB functionality within it in such a way that when plugging in the USB cable, the kernel does not register it and ignores it as if nothing has happened. 

Knock-on side effect - if your device starts boot-looping or mis-behaving, and you want to fix it, it will be trickier to get at it since USB functionality is disabled.

Since OP mentioned its HTC Desire Z, the kernel source should be available on CyanogenMod's repository.

TL;DR: Recompile your own kernel and remove the USB functionality. 

Caveat Emptor I am not responsible for any damage if you go down this route in modifying your own kernel.