You could try to read the unique ID bytes ($48CD:$48D8. They are only present on STM8S105, so here you will read real values, different form 0x00, while trying to read the option bytes on STM8S005, where they are not available, you should only get zeroes, 0x00.
It was my only idea. Usually, when trying to read a reserved/unavailable memory space in 90% of cases I get 0x00.
You could try to read addresses $5206 and $5207 (registers SPI_RXCRCR, SPI_TXCRCR), as the datasheet states that these registers are 0xFF after reset on STM8S105 and 0x00 on STM8S005 - but I would say it's rather an error in the datasheet.