True, any new task even though how tiny it might be, needs few hours to understand and get the local environment up.
The onboarding of a new client requires some effort even if the same devs remain the same. So in the long run it comes down to niching down to specific workflows which are profitable and which is nothing but PMF.
Given, most of the devs who I work with are from my network, the real challenge of confidentiality issues are a bit too early now. But at some point an NDA and his recent work ratings are some factors which could help in avoiding those issues. But again nothing is foolproof.
But stealing the codebase is going too far.