No, it wouldn't be possible for someone with the Eventide app to connect to your H9 and change the parameters while you're performing as long as you take some precautions. Only the registered owner is able to connect to and control an H9 with Eventide's app.  So, it's important to register it, because once it's registered it must be deregistered by its owner before it can be re-registered.  Also, if you yourself don't want to control the H9 via Bluetooth on stage, you can turn Bluetooth off altogether by pressing and holding the X, Y, and Z switches simultaneously.  

There are other additional security measures on top of that as well.  If you want me to go into the details, let me know, and I will.  I think that answers your question though…