Why do you think it is a problem?

See also https://www.limesurvey.org/manual/Installation_security_hints

Thanks for the link for the settings to set up.
We have applied most of the settings on this page.

I am basing this on the conclusions of the intrusion report which indicates that In addition to giving indications on the technologies used, it should be noted that the test pages are not necessarily developed by taking into account the security aspect. Leaving them on a production server therefore unnecessarily increases its exposure.

We therefore think that this is indeed a problem.

So, these files are indeed necessary for development, but we could delete them / make them inaccessible for production.

The swagger is quite impressive (the features do not work on my environment, with the restrictions in place) and allows a lot of features. It is functional for the demo environment for example:

https://demo.limesurvey.org/docs/swagger/