I've been in the habit of leaving sourcemaps in the production drops for this reason that by it's nature it's not exactly secret, even if the code isn't strictly "open source": if someone is that interested in the non-minified version they are likely to use a deminifier anyway and obfuscation isn't security nor copyright law enforcement. Plus it's also selfish and lazy to leave the sourcemaps accessible (thus the business case for it): as much as you work to prevent having to debug things in production, you will almost always need to debug things in production.

Sourcemaps are great.