As others have pointed out, any file used on the client side, whether HTML, JavaScript, CSS, or anything else, has to be sent to the browser for the page to work, and therefore can't be locked away. If a browser can't read it, the page won't work; if a browser can read it, a person can read it. However, it is worth mentioning that there is, indeed, a security implication to this: the user can do anything he or she wants on the client side: run a custom browser, modify the HTML or JavaScript you sent out, and so on. There are lots of tools for doing this, some of them for developers and others for people who like to modify CSS so they can look at pages the way they want to see them. In any case, what this means is that client-side code is never secure. You can't ever be sure that the code you sent is the code running on the user's computer, which means that you cannot automatically trust input coming back to the server from it (nor can you really send data that you want the client-side code to process but that you don't want the user to have access to). Most people know that you have to treat user input carefully to avoid things like SQL injection attacks, but really you need to realize that "user input" doesn't just mean form field values, it means anything coming from the user side, even values generated completely by your script...because it may or may not be your script that your server is actually talking to.
