Except the payout script is in a directly with a long random string that I tell my customers to change. 

The deposit script is protected with a token.   And since withdrawals need to be approved manually, your points are moot. 

Don't feel bad for my customers.  Let's call a spade a spade.   Only one of us has gone out of our way to steal from people.