State messages like "x has entered/left the room" or "x has changed his/her avatar" reveal identities present in a room, which we wanted to keep private. That information is sent by the server, but not displayed by the client. Quite probably there might be a better solution for this, but we looked for a (quick) solution that worked for us, since the combination client-server is supposed to be a closed ecosystem. We were (and are still) in the middle of a pandemic, and just wanted to get it to work in an acceptable manner.

You probably will be able to rip the app appart and get the keys, but why would you, we are just a little primary school. It's up to real experts to find an elegant solution for all of this, if there is demand for it on a bigger scale.

That's what "hide" usually means. It's not like all hell would break loose if someone ever found a way to start an unscheduled group, it's just UX streamlining, don't distract people work options they don't need.

I'd say a dedicated hacker could walk through their system like a laser through butter anyway. After all, it's just a random school, lacking expertise as also manpower for proper quality. Their long term goal should be to get the same experience from a proper managed project. The problem is that official projects have just started to move into that space. German Public IT is insanely far behind in that regard.

...a honeypot to discover technically minded students?

As it is an elementary school it is unlikely that a pupil will "hack" it, however some parents or big brothers might. But I wondered the same, especially as they state they also want to block parents from talking to anybody, except the teachers.

But maybe that can be augmented by serverside configuration and the change in the client is about taking away the options, which would be blocked by the server anyways.