I recently wrote an article that dives into the question of “can Meteor questions be mobile only?”
The short answer is no! The Meteor build tool will always target the browser platform, and you application will always be accessible at the application’s root URL.
Users will always be able to dig through the application’s Javascript bundle pushed down to the client, and they can always interact with your server through the Meteor object on the client (or connecting to your DDP endpoint directly). All of this is possible through the browser, not to mention using dev tools on a mobile device.
The moral of the story is that you should always focus on securing your server. The war for Meteor security (and all security) is fought entirely on the server.