I recently wrote an article that dives into the question of “can Meteor questions be mobile only?”
The short answer is no! The Meteor build tool will always target the
browser platform, and you application will always be accessible at the application’s root URL.
Meteor object on the client (or connecting to your DDP endpoint directly). All of this is possible through the browser, not to mention using dev tools on a mobile device.
The moral of the story is that you should always focus on securing your server. The war for Meteor security (and all security) is fought entirely on the server.