It's only worth it when it has real value and doesn't introduce undue operational overhead. I've worked at multiple places where I was told by CISSPs (!) that

It's only worth it when it has real value and doesn't introduce undue operational overhead. I've worked at multiple places where I was told by CISSPs (!) that we mustn't under any circumstances name the servers after what they do because then "the hackers would know what to attack" and that we must instead name them after superheroes or tequilas or some other such whimsy. I pointed out that getting LDAP bind credentials or the zone file from Active Directory is a tall order and that `nmap`ing the subnet for running services is ten times easier only to have the same tired rationale parroted back to me with an appeal to the authority of some 15-year-old security "best practices" document. I've also had similarly-futile discussions about disabling ICMP, browser development tools, RDP/SSH timeouts, and a dozen other things that I've forgotten by now and at no point did I ever get a good reply when asked about why we were introducing so much pain for so little tactical gain. To be clear I always make it a point to disable unused services, change account names, rename wp-admin, etc. because those aren't serious operational burdens and indeed reduce attack surface significantly, but at some point "defense in depth" becomes self-perpetuating box checkery designed to create security work streams. As somebody who cares about practical security _and_ delivering a good experience it's maddening.