WSDL is an XML-based format which describes how one ought to talk to a given Web service. However, this is not the only incarnation of that syntax. The server itself knows the syntax (of course) but also the legitimate client.
If an attacker wants to know how to talk to your Web service, he just has to reverse-engineer the client code. The client code is deployed in various places, it is a file written on disks and backup tapes and distribution mediums, it is also in the head of several developers, and the protocol may be documented and printed, so the attacker can scan the trash bins at the development site to obtain the information about the syntax. The WSDL can only help the attacker, but it would be a mistake to believe that without the WSDL the attacker is severely impaired.
As @Rook says, letting your Web service publish the WSDL is convenient for tests; it is also good for interoperability developments. Since any sane security policy has to assume that it is public or almost public anyway, you may at well leave it public.