It’s not what you think. It’s more about disclosing business-related data or metadata (e.g. customer names, last time a customer logged in) than technical information (e.g. internal service names, minor debug information).

Good security means not kidding ourselves that backend implementation details are providing us with any defense.

They're not, and if we base our security strategy on the assumption that they are then we have at least one weakness in that strategy.