Security by obscurity is a problem because a site can get destroyed if one person discovers the flaw. He cares mainly if a not insignificant number of his patient discover him.