I'm not sure security through obscurity is a great practice?

Not to mention, I presume the core bits of Cal.com's source code are already in place and aren't going to change significantly?

Like, this feels like a business decision and not a security decision