Yes, but they can still access the api directly - and see which type of encryption is used even, anything like that
And in general, I think it's quite unprofessional if an application is vulnerable
BeeByte seems okay, it's very very simple, basic renaming of types, methods, and it has string encryption + junk code - but alot of people can never unpack it fully