Security through obscurity is great for preventing low-effort attacks at low-scale, yes. The market for security skills tends to be more interested in protecti

Security through obscurity is great for preventing low-effort attacks at low-scale, yes. The market for security skills tends to be more interested in protecting targets that can draw high-effort attacks, or low-effort attacks at scale, so there's good reason for the "security through obscurity = bad" meme. You won't get in trouble by incorrectly assuming "security through obscurity = bad," but you can definitely get in trouble by incorrectly generalizing "security through obscurity = good enough." It makes sense to err in the direction of least damage.