I've recently started underscores to make custom one off themes for clients because I like starting with a blank canvas. I see that lots of websites use custom themes which are generally named after the business they are made for, however I am concerned that using underscores as a one person team will leave my clients open to future security threats and it's also very time consuming. Is there something I'm missing here? How are small web design studios able to make one off custom themes and keep them secure?
Every custom theme I buy is fully customize-able, so I do not understand what you mean by secure. I see the themes I buy as starting points towards achieving a particular goal, instead of starting from scratch. Some themes complicate their code, so that buyers cannot edit them easily, but it's unnecessary. All in all, themes create HTML with CSS and JS which is totally view-able in the front-end.
In fact, most of these small one person company will simply rename the theme before they put it up live. They can either start from scratch or not, but it is usually pretty easy to change a theme's name.
As per security, you should make sure to follow the usual guidelines. WordPress has a great post about theme security : https://developer.wordpress.org/themes/theme-security/