Comments are removed already by a preprocessor. So the comments do not even make it to the compiler (which would remove them too anyway), let only to the binary.
You can easily check that by calling SaveToFile at the end of your .iss script and checking the generated Preprocessed.iss file:
#expr SaveToFile(AddBackslash(SourcePath) + "Preprocessed.iss")
For example this:
[Code]
function InitializeSetup(): Boolean;
begin
{ Secret comment }
Result := True;
end;
#expr SaveToFile(AddBackslash(SourcePath) + "Preprocessed.iss")
... will be filtered to this by the preprocessor:
[Code]
function InitializeSetup(): Boolean;
begin
Result := True;
end;