I would've expected the firmware to be protected.

That AVR ISP string might hint that there is some sort of bootloader together with the code, maybe that's an Arduino without the serial-to-USB bridge chip? (I didn't check)
Another guess, maybe the strings are in the eeprom area. See how to read the eeprom area from these AVRDUDE examlpes:
https://avrdudes.github.io/avrdude/8.0/avrdude_7.htmlIf you do that, and save the eeprom content as "backup_eeprom.hex", then to see the strings from a .hex in Linux, from a terminal type
xxd -r -p backup_eeprom.hex | stringsIf you can, read all (the
flash, the
eeprom, the
efuse and the
hfuse), zip them together and attach the zip here, please.
Side note, AVRDUDE can save as binary, too, if you want. So if you save what's read as .bin, the above line becomes
strings backup_eeprom.bin. Though, human readable files are preferable to binary, so saving in .hex format is better.