if someone is after you specifically, _anything_ you do can be significant.
however, if someone is not after you specifically, but is just after things that they can sell, it becomes much easier to have reasonable defenses
"I don't have to outrun the bear, I just have to outrun you"
with "you" being enough other users that the bad guys don't get around to bothering with me.
yes, this is security by obscurity, and if someone decides to go after you it doesn't help much, but the reality is that for the vast majority of people this really is good enough.