Several ways. Simplest is a 3-pole double throw (and for extra feature, make it center-off) toggle switch, but it has to be big enough to handle the full DC current of the phases during regular motor operation, and that could be a big switch. Since you'd never be switching it while power was on, it can be smaller, but still not a tiny thing.
Wire one set of poles to the controller phases.
Wire up the center pins to the motor phases.
Wire up the other set of poles shorted across each other.
Toggle the switch to the controller and you have normal operation.
Toggle it to the shorted poles and now it's a heavy load on the motor with teh controller disconnected from it, making it really hard to rotate the motor at anything above hand-rotation speeds, so you couldn't ride it away.
The active antitheft in controllers is "better" in that it actively fights the motor rotation at any speed, but it uses a lot of power to do that. This method uses no power.
You could also do it with relays, so that when the bike is off, the relays are shorting the phases. But it's possible for vibration to close a relay contact sometimes, which could be bad. Or for you to be riding along and have the BMS cut out for whatever reason, or you otherwise lose power, relays close, motor actively stops rotation, and bad stuff happens (especially on a front wheel).