How is strictly controlling exposed server resources to only URIs you’ve confirmed should be an exposed an example of “security through obscurity”.