commercial sites have the easy ability to go to https://github.com/mholt/caddy; download the source; remove the header from header.go and server.go; compile; run
i'd venture to guess many build the binary themselves already. so they can add their own tweaks.
how would anyone be able to prove a website is being ran by caddy if the server doesn't announce that it is caddy?