The fact that a security mechanism is poor shouldn't mean that it doesn't create a legally enforceable boundary. If I tape my door shut instead of buying a proper lock, that doesn't give you the right to walk in.

Bad analogy. A door is an access control mechanism. A Uniform Resource Locator is not.

A more apt analogy would claiming that having your phone number not published in the phone book constitutes a legally enforceable boundary against being contacted by phone.

We can debate about whether URLs have elements of an access control mechanism or not, but if obscured URLs don't create a legally protect-able boundary, the argument should be because they're not an access control mechanism, not that they're a poor access control mechanism (which is the usual implication of "security through obscurity"). In other words, the argument should be about how clearly the boundaries are drawn, not how effective the security mechanisms are.

Granted. The security-through-obscurity link was an oversimplification.

Here's an analogy for you:

I don't publish my address in the phonebook or anywhere, but because you know that 4001 Example streeet is a house and 4003 Example street is a house, you're still able to solicit me at 4005 Example street.