Indeed, overly broad denunciations of 'security by obscurity' come up as a point of confusion often on HN, and this post provides a good, coherent summary of a proper response.

A defense mechanism that only partially mitigates an attack vector could be considered 'security through obscurity' if deployed on its own, but that same mechanism could be considered 'defense in depth' if deployed alongside other defense layers as part of a more comprehensive security model.