Dismissing security through obscurity as pointless is an advice from the 90s. Basically security comes with layers of obscurity. Even key based auth is a rando

Dismissing security through obscurity as pointless is an advice from the 90s. Basically security comes with layers of obscurity. Even key based auth is a random string that no one is meant to guess. If you have more obscurity, the less chance one reaches to the actual attack surface. If an attacker gains a key, without fail2ban etc, he may try bunch of user names against the key file consecutively but if a login attempt is limited to 3 times every 5 minutes, see it's better than nothing.