When building a release, the src/**/Tests are not excluded from the composer archive.
That should not be a problem as there are no secrets stored, or harmful exploits in the unit tests. Still, a prod release could exclude that code. You would not be able to run those tests in production anyway as phpunit is installed as a dev dependency.