yes. what's wrong with that?

Security team said that it's suppose to not show the code or at least return a 404 error

your security team is saying youtube is insecure then

that code needs to be accessible because your web app consumes that code

if that code is not accessible how does your web app even function

so it's important to not import server-side logic/api keys into the bundle

and use them in only server-side places

but is it okay if it shows in public?

it is okay and it is how it is supposed to be done

does that means that this is not a vulnerabilities? because they added this in my workload saying it's' a information disclosure type of vuln.

if the said file includes some secrets like API keys and similar stuff, then it is a vulnerability and you need to investigate how such secrets manage to be leaked to the client-side bundle

but if they say it is a vulnerability simply because it is a JS file and the URL starts with _next, they are wrong