Closed-source code isn't that much less secure than open one that I think this is a legitimate worry, especially in this case where the obfuscation doesn't sound like it was effective much

They already released deobfuscation mappings years ago. Modders already have a deep understanding of the Minecraft codebase.

Whether is obfuscated or not. Minecraft java runs most logic in java, and write the save and network handling in parse & validate style instead of serialization/deserialization style. So there isn't much "vulnerabilities" for you though. The game probably isn't best in performance, but there aren't much vulnerabilities either.