I guess this only matters for specific types of apps (e.g. unlock functionality when a user pays) where most of the action happens client-side? Still seems like

I guess this only matters for specific types of apps (e.g. unlock functionality when a user pays) where most of the action happens client-side? Still seems like security-through-obscurity because eventually the user ends up with the client-side code.