Having a similar constellation as in ScriptDb in Library accessed by WebApp, and also the answer given there applies to this question too:
When a published WebApp ( a
See the comments on Henrique's answer - the library url is not guessable and is not in the webapp.
If anybody debug the public code in script editor and goes on pressing STEP IN
then eventually he will reach at the library code. So you can not hide the library code in any way.
I initially thought the library key could be seen by inspecting the webapp, but that is not possible. So, you indeed need to share your library to "anyone with the link", but as long as you do not announce this link anywhere, one will not be able to find it just by using your web app.