Comment by Moru

Unfortunately the security by obscurity is backed up by "If a user exploits this, it's a crime and we just contact our legal team." I have seen this happen even in Sweden, local student 16 years old [1] figures out state has a big hole in their school system. He tells state about it and they do nothing so he tries to log in with the admin password he found in a file on his computer. They call the police.

[1] https://www.aftonbladet.se/nyheter/a/bK49Wq/han-kravs-pa-en-...