The bad guys can presume that a small company using that strategy doesn't have skilled enough support staff to understand the vulnerabilities and fix them. This makes them prime targets.

I've had a couple of clients asking me why their server hard disks were full.

I had one client telling me all the computers I'd supplied were way too slow and needed a serious upgrade. Problem was, those computers were working very hard - but they were working for someone other than the owners.

Yeah, obscurity is an open invitation.