Taking a look at the Arduino Uno's schematic explains this, if I understand the schematic correctly. I don't own an Arduino Uno, so I can't verify with a multimeter, so I might be wrong.
As I understand from the schematic, pin 13 of the arduino, the SCK pin, is connected to an op amp buffer. When you (or anyone) upload a program that doesn't do anything to pin 13, it's default state is an input without a pullup.
When a digital pin is configured as an input without a pullup resistor, it has a high impedance (high-Z) and unspecified voltage. It can be 0V, but might be something like 1.5V as well. The measurement will depend on the impedance of your meter, among other things. Upload an empty sketch and check the voltage on the pins - you'll find they're pretty random and not always 0V.
Now, a high-Z input pin with, say, a few volts will not be able to power an LED. However, this voltage is buffered by the Uno's op amp, and repeated on the output. This op amp will be able to power up an LED, and apperently, it does.
I think the Arduino team should add a high ohmage pulldown resistor (e.g. 50kOhm) to make this less confusing.
I'm not aware of a way that this is ultimately possible, though (especially if you have a soldered-chip version) you can make it fairly difficult. So let's concentrate instead on things you could do to prevent accidental or casual modification:
you could disable the reset connection between the USB interface chip and the ATMEGA. This would make it a lot harder to get into the bootloader which is used to download new sketches.
on an UNO specifically, you could reflash the USB interface micro to disable it entirely, or just remove the code for manipulating the reset line (if you still need it for runtime communication)
you could remove the bootloader from the ATMEGA; this would mean you would need an ISP circuit (potentially another Arduino) to change the sketch. In a production setting, you could write a sketch which contains enough of a flash programming scheme to disable the bootloader when it's first run, meaning that you could use the factory bootloader to get your code onto the chip, but then block any further update by that route, though connecting an ISP programmer would still be a possibility for you or others.
In addition to disabling the bootloader or entry into it, you could set the fuse bit to change the reset pin to a GPIO (or is that on the ATTINY's only? haven't checked). This would mean that ISP would no longer be possible, and a high-voltage programmer would be needed; possibly requiring transplanting the chip to a programmer.
You could enable the security fuse, preventing readout of your code, but AFAIK not preventing someone from wiping the chip clean to repurpose it
You could physically cut pins critical to ISP and high voltage programming but un-needed by your application, flush with the package. This would require someone to dig further into the package to get the connections to reprogram that chip, but -
Remember that nothing you do can overcome the relative ease of swapping out the ATMEGA part for a new one, or more simply swapping out the entire Arduino for a new one. (Well, I suppose you can bury the whole project in a large mass of potting compound...)
Best Answer
The functionality of the micro-controller will not be compromised, assuming you didn't do anything else to the micro-controller. You won't be able to use that GPIO pin.