It's only a bad thing if the obscurity is critical to the security of what you are protecting. For example if you make your API completely open, but obscure it inside an app and make the domain hard to discover e.g a random string that's obviously not good.

However if you use obscurity as an extra layer in a system that is secured by other means such that removing the obscurity would not have an adverse effect on the security of the system that's fine. Hence there's no reason not to obscure things to make it more difficult for an attacker as long as that's not all your security.