[meteor dev] This is on us. The docs don't make this point clearly enough. It's also the single most voted for thing on the Meteor 1.0 roadmap: https://trello.com/card/patterns-for-writing-larger-modular-...
JS files in the 'server' directory (or any path with a 'server' component') are not sent to the client.
Everything else is.
Putting code inside an `if (Meteor.isServer)` block doesn't keep it from the client. Now someday we might statically analyze the code for clauses like this and keep them out of the client bundle -- the first step is greenspan's jsparse package -- but not likely in the short term.