Version bytes select the human prefix and, by SLIP-132 convention, the address type: xpub (0x0488b21e, legacy BIP-44), ypub (0x049d7cb2, nested SegWit BIP-49), zpub (0x04b24746, native SegWit BIP-84), with tpub, upub and vpub on testnet. Output descriptors (wpkh([fingerprint/84h/0h/0h]xpub…/0/*)) now express the address type explicitly instead.
An xpub is not secret in the sense of spending, but it reveals every past and future address of the account, so sharing it is a privacy decision. Combined with one child private key it also reveals the parent private key, as described under BIP-32. The xpub inspector decodes the fields and derives addresses locally.