Security plus obscurity probably does beat obscurity (as long as you're not trying to rely on scanners to find the vulnerabilities in your own network), but the

Security plus obscurity probably does beat obscurity (as long as you're not trying to rely on scanners to find the vulnerabilities in your own network), but the people asserting this are almost always doing something horribly wrong (e.g. using SHA-256 for passwords, like this guy is doing). Even if this is not the case, moving your SSHD to a high port is unlikely to be as effective as just switching to public-key crypto, which doesn't end up taking more time. Etc. In short, you're right in theory, but in practice obscurity is pretty much never the right answer.