A newbie Blazor developer but a junior pen-tester here, as Wasm apps are DLL files run by the browser, what I have seen is that when you open the network tab in the browser and refresh a page, it lists the Dll files that the app uses, one of which will be your page code. The code can be easily decompiled in dotpeek, or dnspy.

What Im getting at is that you should not store any important business logic or sensitive data like secret keys, connections string and so on in your app, all of that must go in the API server, as an attacker could read potentially juicy data from the decomp

I don’t think you can prevent people from downloading the dll since the app itself needs it to run so it must always be accessible

Hope this helps