The outdated DREAD risk model (wikipedia) lists Discoverability as a criteria for judging the severity of a vulnerability. The idea being that something which is not publicly known and you would be unlikely to discover without deep knowledge of the application in question does not need as much panic as, for example, something with a published CVE (assuming there are no publish attack prototypes, since that bleeds into the Exploitablility metric).
I notice that CVSS v3.0 has no metric for how likely the vulnerability is to be independently discovered.
Wikipedia has this to say:
Some security experts feel that including the "Discoverability" element as the last D rewards security through obscurity, so some organizations have either moved to a DREAD-D "DREAD minus D" scale (which omits Discoverability) or always assume that Discoverability is at its maximum rating.
So my question is basically: apart from the very obvious "security by obscurity is bad", what are the arguments for and against using Discoverability as part of a risk analysis?