Yes, I include source maps in production. It only gets loaded when someone opens dev tools, and it provides better error stacks which makes debugging easier.

You're correct that it's security through obscurity. IMO, it's an irrational fear.

My favourite is to create them and link them, but host them from an internal server so that no one external can access them (eg hosting it at http://internal.example.com/source.map) - so if anyone tries to load it, either the dns won't resolve or they won't be able to access the server.

Just yesterday I used the source maps provided and a short script to "reverse-engineer" a third party's minified Webpack bundle into a tree of original source files, complete with comments...

I wouldn't, or to be more precise - I wouldn't by default. I prefer to enable things like source maps via an environment variable or a special build - when I know that I need to debug something. By always including source maps, I just increase the asset size for the site's visitors, with "no benefit" (most end users won't have a clue about how to debug something).

Regarding the security aspect - don't put anything you know to be sensitive/insecure on the Internet in the first place.

Source maps aren’t actually loaded by the browser unless specifically requested by opening web inspector, fwiw.

We include them, but lock them away via nginx rules for sentry and dev IPs.

Locks make good neighbors, but they wont stop a thief.

You're not obligated to make it easy for someone to reverse-engineer/steal/clone your client code.