Illustrative example: I had to deal with a third party that we needed to integrate with because of anti-money laundering procedures a year or two ago. I wanted my team to setup a privatelink with the organization because that's generally more secure than an open sftp port. The company refused citing security reasons to hide their Account Id (it's needed for the role ARN used for reciprocal permissions to PV endpoints). So what did we do?
We ended up whitelisting a range of public IPs they use for inbound port 22...
Moral of the story: you may think you are a genius for obfuscating your IDs, but you can't really run a business unless people have an address back to you