Any competent vulnerability scanner won't check for headers or similar information; instead, it'll just try dozens or hundreds of known attacks and checks if one if them works.
Why that? Because there's so many reasons why the header info might be wrong.
You might, for example, be using a long term release of Ubuntu, Debian, or RedHat. In long term releases, they typically fix the version number when the release comes out; during the lifetime of the OS release, they'll backport fixes but won't upgrade the version. So your "SuperServer 1.2.3" will, after a while, still announce itself as "Superserver 1.2.3" but include all the fixes (but not features) up to version 1.2.17.
For all but the smallest web sites, you'll connect to some kind of load balancer or reverse proxy which distributes your request to one of several backend servers. But there's only one
server header. So even if it says
Server: nginx you may be successful trying some apache exploit - attack the backend apache even with an nginx-based load balancer. Or vice versa.
So, any automated scanner will just try out as much as it can in order to not miss out on anything.
20-25 years ago, this kind of automated vulnerability scanning didn't exist, or at least wasn't as widespread/easy to as today. In those days, some people would actually try to find out stuff about server software, look up vulnerability lists, and try exploit those manually, themselves. But today? Not a chance.