If you publish your code on github, it's more likely to be compromised than if it's just in the webapp, very well obfuscated.

A sufficiently motivated actor will break it, and frankly break almost anything else, so it's a game of probabilities etc..

Obfuscation probably does make sense so long as it's not obviously getting in the way of dev. and, with the key understanding that 'it can be broken'.

Physical security at most companies can be thwarted with enough effort, it doesn't mean we don't do it.