Obscurity is part of security. I have personally found that by using non-default ports for services that attempts to break in have gone down to zero. For example if you leave port 5900 open I guarantee your going to have bots trying to break in day and night. Someone would have to be specifically targeting my network to even find the ports I use(a port scan takes a good amount of time) and the services behind those ports. Of course that's not the only security in place, there are many layers but obscurity plays an important part.