Are Oracle Forms migrated with ORMIT™-OpenJava as secure as before? When users can see the code in the browser?

Yes. Users can see and even change the code running in their browser, but every save is validated again on the server, so nothing the form wouldn't allow can be saved. Sign-in is unchanged, extra checks can be added at the API level, and a strict Content Security Policy (no unsafe-inline or unsafe-eval) is supported.