When someone obtains your bot token, they can use it to login to that bot . However, they technically cannot view any source code as it’s on a separate server. If someone does obtain your token, this can lead to abuse, and even your bot account being deleted.
Read more