Can I restate the go question as "is complexity of the machine effectively security by obscurity and effective in practice for reliance upon?" Really how much

Can I restate the go question as "is complexity of the machine effectively security by obscurity and effective in practice for reliance upon?" Really how much unnecessary complexity is traversing boundaries we can shut down or at least gate effectively? My company has used CICS for this purpose since forever and we're not so much a legacy that you will think about our architecture in this way if we talked about it, but CICS is a very rare interface in this era.