If Security through Obscurity isn’t working, consider Security through Stupidity, I guess.
I worked with some oilfield SCADS folks in the early 2000’s who used open IP for their valves, who were very convinced no one would use their equipment because “no one knew they were there.” At some point, it’s no longer trust in good actors.
Compliments to the authors, someone owes these guys challenge coins.
I would suspect it’s a humility issue. It’s a constant challenge, for me at least, to be vulnerable about my weaknesses and not be bull-rushed by other men seeing an opportunity to push me down. Fortunately I’m the boss now, so I can set an example that I can be wrong and trust others to say I’m right, or step back and admit a weakness that another can cover.