Deploying services on non-standard ports has often been dismissed as security through obscurity, but this is just one example where defense in depth can provide

Deploying services on non-standard ports has often been dismissed as security through obscurity, but this is just one example where defense in depth can provide protection even when other best practices are also followed. App-layer scanning across all ports would be substantially more complicated than just standard ports, and additional measures like port knocking could provide even better protection. WireGuard does really well here, where an authentication failure is indistinguishable from no WireGuard service at all.