I discussed this with Jim and he agrees that this does not need to be confidential.
Two things that we came up with:
a) disable developer mode by default
b) log a warning when developer mode is turned on, maybe even put a
red banner in the ZMI to say "You're in developer mode. Don't use this in production." (or similar)