without open-sourcing the whole thing
Obfuscators/minifiers can be used to remove the source code.
Your code wasn’t secure anyway, because there have been module stealing exploits in the past. However, with obfuscators/minifiers, your original source code can still be secure while allowing code to be run on the game server. Roblox keeps the source code of their client private, but the compiled client can still run on your computer or phone. That is essentially what obfuscators/minifiers do for Lua code.
running the risk of having their hard work stolen
The usage of a remote webserver that will generate code to be sent to loadstring for a specific game instance using job ID, place ID, the time, and other variables specific to that game instance can be initiated, so that the script will run only on that game instance.
The Roblox client can be copy and pasted to other computers or phones, but it still relies on Roblox servers to operate correctly. Using remote webservers to generate a script made to work only with a specific job ID and other variables accomplishes the same thing.