That’s not what “security through obscurity” means. It specifically refers to security based on the secrecy of the system’s design details. Like many terms of art, the meaning is not exactly the literal meaning of the words.
That's not what it means. No one disputes you should keep passwords, private keys, certificates, etc. safe.
It's about obscuring the architecture of a system in order to protect it. And I agree this shouldn't be a tactic. It can be a byproduct of your disclosure strategy (i.e. AWS don't disclose how their products are built) but not a security mechanism (i.e. AWS don't meet all the certification standards BECAUSE they're not disclosing how their products are built). Just my 2 cents.
It's all about threat prioritization and defense in depth.