This also annoys me, and how people don't realize how fragile this solution is. But I think it's like moving your ssh daemon to a random high port: it doesn't

This also annoys me, and how people don't realize how fragile this solution is. But I think it's like moving your ssh daemon to a random high port: it doesn't change the nature of process, it doesn't provide any guarantees, and it's not the only/last thing you need to do, but it's believed to filter out enough problematic actors that it's worth doing, for both senders and receivers. (But I get now your complaint isn't about that, and this isn't the best analogy. You're saying that this is a slap in the face to people who don't know that address; they shouldn't be likened to "attackers.")