It imposes costs on all attackers. The value of that cost is skill dependent, but no one has unlimited time on their hands. In other contexts, like hiding an ad

It imposes costs on all attackers. The value of that cost is skill dependent, but no one has unlimited time on their hands. In other contexts, like hiding an admin login page, shutting out low skill attackers means your log files have better signal to noise, and you can focus more resources on the more significant threats. The reason I say to think of it as a preemptive strike rather than a defense is that you still do need strong defensive layers. This is basically just setting a compiler flag. It's free for you and costs something for the attacker.