If showing a command is a security risk, that implies something like a user seeing an “admin” command they can’t access, and then working to get somebody to grant it to them. If that’s the case, then Figma’s excuse sounds like a classic case of annoying the majority for the sake of a minority (who in this case can’t sort out their own security policies). Again, bad design I would say.