I suppose even a hypothetical expensive exploit (requiring ten minutes per attempt for example) would not deter someone with a large botnet from trying it again

I suppose even a hypothetical expensive exploit (requiring ten minutes per attempt for example) would not deter someone with a large botnet from trying it against every server. So while hiding version info might save from some attackers in some scenarios it doesn't provide real protection.