Anyone capable of doing damage already knows how to format and read minified code anyway. I do it in prod all the time when I want to test something with an override, which causes the source map to become invalid.

I work for a large software corp and we generally keep them in prod because it makes debugging prod issues much easier. The browser only downloads them when the dev tools are open.