But would they be able to find those obscure exploits if they had no idea what your code looks like?

If all you had was an API endpoint, you wouldn’t realistically have any way of figuring out how the internals work and finding obscure exploits.