App Store code obfuscation?
You can indeed easily find those. But no worries, URL calls are also easily found by monitoring network connections. The trick is to communicate through SSL using POST.
the App Store build you make secures the app somewhat (DRM and what not), but I believe a simple HEX editor can get some stuff back. Reverse engineering is always an option.
I wouldn't worry about finding the URL's, I'd worry about how safe those calls are. People will always be able to find the things you like to hide. The trick is to make it impossible for them to (mis)use it.