How do deployment profiles keep Hub publish out of production?

Publish always uses the Hub connection on the currently selected deployment profile. Create separate profiles (and credentials) for development, test, and production. Switch the profile before publish — there is no extra “are you sure this is prod” gate beyond which profile is selected.