Security is only partly about the threat model. The other part is the failure mode. If your failure mode is “our company goes out of business if our code ever leaks out” then you’re probably too heavily invested in security by obscurity.