Preventing people from ddosing your auth logs leading to false negative fatigue that lowers the effectiveness of your login monitoring security measures is actual security, not security by obscurity.