You are wrong. This is not security by obscurity, but exactly the same security class mechanism like used in other token based systems. You cannot access generated pdf file unless you know the exact report file name, which is long and randomly generated (not obscured!). If you think you know better way to provide pdf files, just write the code, pack and send to our contributions mailbox, then we will consider integrating your work into main FA code.
Regarding invoice number vs invoice reference thread, this is very interesting as example of local specifics, but I'm not sure the Bug reports forum is the best place to report this. I think it would be better to stick to terminology used in FrontAccounting instead, were internal unique transaction number is named Payment Number, Order Number or just Invoice Number in the case under consideration, and another arbitrary string assigned by FA user is name transaction (payment,order, invoice...) reference. I think it is counterproductive to force your point of view in this matter here, were exactly such terminology is used since the project beginning.
There are also good news in this matter: you can always make your own translation file (say de_LU.po) and name invoice reference as invoice number and vice versa, wherever you feel it is necessary .