He doesn’t claim the NYT is the first to discover his identity, only that that are big enough to for that revelation to be pernicious.
Yes, it's fragile, and most people doing this don't have great opsec. But in general it works fine, as the threat model of someone looking you up on Facebook doesn't require a great deal to defeat. It's really rather unhelpful, however, when someone with high Google karma decides to publish that information you want kept secret.
Like, I could have RCE's in my software and hide the source to hopefully slow you from finding them. ... or I could fix the bugs!
But for many things, being "actually secure" isn't cheap or even possible at all... and perhaps obscurity and other less strong tools are the best anyone can do.
When there's not an obvious way to do it, you have to fall back on the chouices that you have. The choices for a psychiatrist seem to be not have a blog or online profile at all, or run one under a pseudonym.