I've seen the same thing with small tools. It's easy to focus on hiding the logic, but trusting a price from the browser is the bigger mistake. Always let the server have the final say.
Exactly. Obfuscation just buys a false sense of safety, anyone with the Network tab still sees the request go out. I keep a client-side price purely for the instant feel while someone drags a slider, but the server recomputes it from scratch at quote and checkout, and that number is the only one that counts. If the two ever disagree, the browser was wrong by definition.