The reason is because obscure things tend to be less well understood. SSH port being on another port isn't a case of that, but it isn't security by obscurity.

The reason is because obscure things tend to be less well understood. SSH port being on another port isn't a case of that, but it isn't security by obscurity. Security by obscurity might be "I use a non standard PDF viewer, therefor I am safer". But a non-standard PDF viewer may also be subject to less auditing, may not have pressure to improve its security, etc. It's an unknown both to the attacker but also to you. This is where security through obscurity is actually a problem. It also makes it harder to threat model. Do you consider your obscurity as a mitigation when you consider threats to your system? It leads to the temptation of "well, but the attacker would have to know that I'm using this PDF viewer", and then you start to treat that as a mitigating factor. It can be a dangerous thing. Secrets are not obscurity. Randomness is not obscurity. People seem to make that mistake the most.