Isn't that true for software too though? You cannot ever rely 100% on any tool you use, so if you're serious about actually avoiding penetrations and not just about the academic discussion, you're better off using at least a bit of obscurity on top of your real security system.