All software security comes down to obscurity: it depends on the selection of specific numbers that are known to the authorized parties, but are extremely difficult to guess (i.e. very obscure) to the unauthorized parties.

The extreme of this strategy is to make a successful guess cost more than anyone can possibly pay, for example by using numbers so obscure that all known algorithms for guessing them will take longer than the heat death of the universe to succeed, or something like that.

But while there seems to be solid math to calculate such numbers, implementations are rarely perfect and can easily leave open the possibility of other guesses that cost a lot less than breaking the theoretical limit. (AKA side channels, vulnerabilities, bugs, etc)

Where "security by obscurity" comes in for criticism, it's usually because the implementers have misjudged the amount of obscurity they are actually creating, or misjudged the amount they need (their threat model), or both.

It's easy to make these mistakes because it is hard to create perfect implementations, and hard to know exactly the current and future capabilities of your attackers.