But usually I send in an invoice as the first milestone is done (usually there is enough conversation/back-forth for them to know the milestone effectively done - or like a web-demo or something), and softly hint that I'll send in the deliverable (i.e. code and assets) when it's paid.

There's no way a company can take you to task for code what you have written, wherein you have not been paid. Even if they did - it would be a long, expensive process and would be a huge distraction from whatever it is they are trying to do. The pragmatic reality of 'you get the milestone for payment' trumps any kind of legal contextually - if they want to move forward they need to pay, it speaks right to the operational reality of their bottom line.

But lucky enough, I've never had a problem.