FYI, I’ve recently published the package wildhart:dynamic-import-auth which adds authentication to the /__meteor__/dynamic-import/fetch endpoint, so only logged-in users can fetch lazy-loaded modules or components.
edit: Forum post: New package: wildhart:dynamic-import-auth - require auth for lazy loaded code