Good security means not kidding ourselves that backend implementation details are providing us with any defense.

They're not, and if we base our security strategy on the assumption that they are then we have at least one weakness in that strategy.