I wonder if there are any conventions or best practices about the table prefix of any WordPress set up. The official documentation on wordpress.org does not make any statements to that topic.
Furthermore, should I concider the prefix to be a security factor in a case that it obfuscate the table names for a potential invader?
First of all, the prefix is only a configuration option and not a security feature. The reason is that once an attacker has access to your database, he can find out any exisiting table prefix within seconds. There's no way this obscurity protects you from any attack.
For the prefix itself, WordPress asks you to use only digits, letters (here only basic Latin letters a-z are meant) and underscores. (This can be found inside a PHP comment in the wp-config-sample.php file right above the prefix declaration. In theory, with MySQL you can use almost every character in a object name as long as you quote the object name in any situation:
SELECT `über_col` from `über_table` …
Would be possible, however. For compatibility reasons (means: compatibility with queries that don't quote their object names in backticks) you should follow the suggestion
inside wp-config-sample.php which follows basically the MySQL specification for unquoted object names.
Furthermore the specification points out, that a table name must not be longer than 64 characters. So basically its a good idea to keep the prefix short.
To be even compatible with SQLite, you should avoid a digit as first character of the prefix.
A table prefix:
a-z), digits (0-9) and underscores (_). 0-9)