You could also add 2 IPTables rules which would temporarily block all connection requests after hitting a threshold. But I guess actually stopping a brute force attack is less "cool" than changing a port number.
Saying those words and imagining it is so does not make it so. Nothing is fully safe and seeing that attitude makes it even less likely it is
From first principles, what is security through obscurity? It's literally security though something being vague, old, out of date, little known.
That can work. If your physical network is so old that nobody has a network card to plug into it, then they can't hack it. And maybe it works great most of the time. Until somebody finds an old token ring card and laptop.
The problem is, it's only as "secure" as the old school knowledge of the hacker. With an old enough blackhat, all security via obscurity becomes shallow. So as a practice, it's always defeatable.
Real security countermeasures resist all known attacks. Otherwise anything that fools a script kiddie would be valid security.