I'm pretty sure the answer is "No, they can't see functions.php or any theme php files" but I can't find an answer anywhere.
It's always difficult to prove that something isn't there, like the famous teapot circling the earth. So you'll have to trust me that the WordPress source code does not have any functions that might display its own
That said, it would be easy to write such code. So, if you install plugins of unknown origin or do otherwise ill advised things to your site, you could still expose
Not strictly speaking a WordPress issue would be your server's security. If you set file permissions wrongly (in
.htaccess for instance), you could make all your files visible from the outside.