You may be thinking about Blazor WebAssembly which is not even released yet. It will have its place especially for disconnected apps by allowing to run client side code but it doesnt mean all your business logic runs on the client. Only what you choose to put on the client.

But Server side Blazor runs all code on the server (except for some javascript of course to make it all work) so none of the things you mentioned would be on the client.
in addition there should be no hard coded credentials or similar in your code either way. We store all our credentials in secure vaults on AWS for example. only accessible to authorized users from the application.

With Blazor actually a lot more of your webapps code is protected on the server as server side blazor uses a lot less client side code

Biggest issue with using a technology like SignalR with DF WebApp would be the design of the server side.

DF WebApp processes disconnect from the client after a call was made so there is no more active process that could later decide to call back to a client.
if you change the server side to keep a process connected like Blazor does DF WebApp would be to server hungry (each active user would need an active process)
you could of course keep the server processes but make a SignalR router type thing but then you would have the problem of having to synchronize the server side all the time

We have been using Blazor now for a while and i really like the way it works.