As a general rule, security through obscurity is very bad and security and obscurity is still bad. This is because
cypher = AES(plaintext) is already very secure. There is no need to add a custom layer on top of this, and more code means more bugs.
However, what about the biggest weakness of security: users and their passwords? We have password reuse, weak passwords, passwords stored as plaintext, keystroke loggers, and more. Security measures to strengthen passwords (two-factor, password requirements, 3-try lockouts, education, captchas, forced changes, etc) trade away usability for security and so should be deployed only when necessary.
Tricking the bots
There are web-crawlers which scrape usernames and guess common passwords (or stolen passwords). So what are potential ways to confuse the bots?
Change the words. Change "login" to something like "welcome" or combine image letters and text letters next to each-other. Add honeypot links to trap the bots.
Use browser fingerprinting. This is a cat-and-mouse game but any reduction in bot attacks is welcome. There is risk of eliminating "correct" browsers.
The goal is to use obscurity to reduce the number of attacks and to reduce DDoS loads. The industry standard web protocols and algorithms will not change. Is such anti-bot obscurity a good auxiliary defense?