Indeed. That’s exactly my concern. Real hackers are able to exploit any (web) application. But today, in my experience, we have to deal more and more with bored scipt kiddys and low secured default setups. Discourse is currently in beta state but it’s pretty well maintained. I’m running daily upgrades.
As long as most admins would do the same, there is no need for security through obscurity.
That’s just my opinion. There are even more settings (dns, firewall, ssl, database, login, kvm, …) to get a secure system, And backups won’t be bad at all. 