I don't agree. Nobody is claiming that it should be the only layer, but as one layer of many a little bit of obscurity goes a long way. For instance, reddit p

I don't agree. Nobody is claiming that it should be the only layer, but as one layer of many a little bit of obscurity goes a long way. For instance, reddit provides it's public source code but has all of its anti fraud stuff wrapped into a separate repo that is not public. This provides a lot of flexibility that wouldn't be available if it were all public. And sure, some of it is of temporary value ("we are catching this cheating teqnique specifically, until they realise that it's not working anymore") but the fraud arms race is much easier for the atackee if it is slowed down a bit by such temporary measures