Both standard quantum key distribution (QKD) and device-independent quantum key distribution schemes assume that the two parties share an authenticated classical channel. Without authentication, of course you cannot prevent man-in-the-middle attacks.
Authentication can be established using a shared secret (which is why purists sometimes refer to QKD as a key expansion protocol). Or, it can be established using signatures and certificate authorities. It is worth pointing out that man-in-the-middle (MITM) attacks must be made online; if you break a signature scheme a year after the QKD protocol finishes, it does not compromise the key.
Authentication can be established using a shared secret (which is why purists sometimes refer to QKD as a key expansion protocol). Or, it can be established using signatures and certificate authorities. It is worth pointing out that man-in-the-middle (MITM) attacks must be made online; if you break a signature scheme a year after the QKD protocol finishes, it does not compromise the key.