Now you're breaking 403, which is not meant to signal the non-existence of a resource. That's what 404 is for. The "hiding the existence of resources" purpose

Now you're breaking 403, which is not meant to signal the non-existence of a resource. That's what 404 is for. The "hiding the existence of resources" purpose has to be carried by something. The RFC says it's carried by 404, and that's that.