As someone who has been in this field professionally for almost 20 years, my thoughts on this have changed quite a bit. The idea of condemning security through obscurity traces back to cryptography, not security in general. In cryptography, you want the security of your protocol to not depend on the protocol being secret, but the cryptographic keys themselves being secret. There are a lot of good reasons for this, the main one being that the whole point of cryptography is to create protocols that can survive public scrutiny and thus are more easy to implement and more robust.
So for example, without cryptography you'd need to secretly pass a message by courier who might take a secret route, constantly changing his route and delivery time. With cryptography, you can encrypt and sign the message, and then broadcast it over an insecure channel. The second option is much easier than the first. So the whole enterprise of cryptography is based on the principle of abandoning the confidentiality of the protocols themselves.
But there are many situations that require security which are outside of cryptography, because the security of the overall system cannot be reduced to high entropy secrets, and in that case, there is some security benefit that is obtained from obscurity.
For example, we are concerned about username enumeration because we understand users choose weak passwords that might be found in databases, so we do not publish usernames and consider it a vulnerability when usernames are leaked.
As another example, we consider information disclosure consisting of stacktraces leaked to the user to be a vulnerability.
Similarly, there are data centers that cannot just get up and move, and so locations and protocols of these installations are also kept secret.
So while it's true that things which are hard to change should not rely on secrecy in order to maintain their security level, and we should constantly be improving and hardening our protocols so that they can resist public scrutiny, nevertheless it's not the case that all protocols have been or are able to be improved so that their security properties are reducible to high entropy bit strings - in fact most systems don't fall into this category and most will never fall into this category - and for these systems, part of the security will continue to rely on obscurity, even though we are painfully aware of the drawbacks of this approach.