I agree with everything you say about being paid by milestones and nothing is a substitute for getting it in writing, but also consider that I’ve had clients still try to steal software regardless of all of that. For me, and I don’t do this approach on every project mind you, only the ones that I feel will need it, it’s just taking the keys from the car that you haven’t sold yet so they can’t drive off