As a Roblox developer, it’s currently too hard to prevent third-party assets from being sold in games. Fortunately, there’s already an answer to this problem: AllowThirdPartySales! It’s already got a cool name and everything.
However, it seems the feature was announced but never enabled, as explained here:
However, despite the explanation, the feature still wasn’t enabled.
A lot of developers use free models but haven’t yet learned the warning signs of malicious code (unnecessary scripts, requiring module ID’s, intentional obfuscation, etc). The purpose of malicious code is often to prompt item purchases to steal Robux from unwitting players–something that can easily be stopped by enabling this feature, which requires the developer to deliberately enable third-party sales.
Also, it’s probably a good idea to migrate the setting from Workspace to Game Settings, since most similar settings have already been moved there.