Of course it does. Do you really think you have full control over API output? Do you really think "the system prompt you can specify in an API call" is the system prompt and not the developer instructions prompt?

I think the definitive point is that it should be documented. Security through obscurity all by itself isn't security.