Keeping a capability secret is a perfectly valid approach to providing security. If you publicise a capability then an attacker can work to defeat that capability very easily and directly. By keeping it secret you force the attacker to first find out you have it and unpick that capability in order to defeat it.

Security by obscurity cannot be the only approach to security, but it's certainly a valid tool. Militaries and security services the world over rely on it throughout history for instance.

I can only guess that "obscurity" is an excuse for the defects of GitHub's machine learning of spammer detection. The spammers can always check if their accounts have profiles even if there is no notification.

(Don't know why you and all my neutral comments are downvoted. Angry GitHub employees here?)