Cybersecurity is mainly a technical application of risk management. An untrusted network (the internet) is a risk. Removing access from that network is one way

Cybersecurity is mainly a technical application of risk management. An untrusted network (the internet) is a risk. Removing access from that network is one way to mitigate that risk. Obscurity doesn’t remove a risk, it just reduces its likelihood. An obscurity approach here would be more akin to changing your SSH port from 22 to some random number rather than blocking SSH entirely.