Well, the first thing that comes to mind is that if you remove an external endpoint of an API that an application relies on, then yeah, it would probably break. :)
More specifically it really depends on the application in question. If it only works over XMLRPC and it needs to connect from a different machine, then yes it will break if you remove the access. Otherwise it might not. The fact that it is publically accessible does increase the risk to your server(s) because of an increased attack surface, but if it's a properly secured service then there is less risk. There is still an increased attack surface though.
However, since it is XMLRPC, which is an antiquated protocol (a precursor to SOAP), there is a good chance that it wasn't necessarily designed with security in mind.
Removing the API would not be security by obscurity unless there is another way to access the API whose protection hinges on the fact that XMLRPC was the only known public endpoint.