Sure. And you can do system identification even on a blackbox if you know the inputs and outputs, so what you are proposing is technically not 100% safe as well. The best obfuscators today are pretty darn good though and offer a reasonable level of protection against the allure of casually decompiling the code to understand it. One cannot protect against someone deciding to hire the best people in the world to reverse engineer your IP beyond extreme secrecy. But at the end of the day it's about who you do business with, right?
Yes, doesn't make sense. For 17x return with scalabitliy into the millions.. Either he's lying, drunk, or plain stupid. I'm gonna give him the benefit of the doubt and assuem he's a raging alcoholic and can't think straight.