There are many so-called software engineers who respond with some variant of "no one knows about it but us, so it's fine". It's not even security-through-obscur

There are many so-called software engineers who respond with some variant of "no one knows about it but us, so it's fine". It's not even security-through-obscurity, as no particular efforts are made to obscure the resource, just that no particular efforts are made to publicize or document it and thus "that's good enough security for MVP".