>obscuring your login service via non-standard ports or even a requirement to try several ports in sequence really only buys you security equivalent to lengthening your password by two characters per port.

Not even that. It's like a separate two-byte password because you get to guess and confirm the port separately from the password.

Lengthening your password by N bits multiplies the number of necessary guesses by 2^N. Having a separate N bit password adds 2^N to the number of of necessary guesses. So if your real password's effective key length is more than 16 bits, using a random port effectively adds less than 1 bit of entropy.

Also, rate-limiting port scans is way harder to do than rate-limiting authentication.