Yep. Too often people fall into a binary way of thinking - it's either perfectly secure, or not secure at all. It's like that bell curve meme with the dunce at one end ("we should obscure our system"), the midwit at the peak ("security through obscurity is not security", and the genius at the right ("we should obscure our system").

Obscurity *by itself* is a poor security posture, but it can decrease the surface area for automated attacks substantially. A determined human can figure them out eventually, but if their bot never sees you in the first place, the human might never even attempt the attack.

Obscurity is not a bulletproof shield, it's another layer of Swiss cheese.