If these were propositions made in the context of information security, then they all would be examples of security through obscurity. From the Wikipedia article linked:
In security engineering, security through obscurity is the use of secrecy of design or implementation to provide security. Security through obscurity is discouraged and not recommended by standards bodies. A system relying on security through obscurity may have theoretical or actual security vulnerabilities, but its owners or designers believe that if the flaws are not known, then attackers will be unlikely to find them. A system may use security through obscurity as a defense in depth measure; while all known security vulnerabilities would be mitigated through other measures, public disclosure of products and versions in use makes them early targets for newly discovered vulnerabilities in those products and versions. An attacker's first step is usually information gathering; this step is delayed by security through obscurity. The technique stands in contrast with security by design and open security, although many real-world projects include elements of all strategies.
Security through obscurity has never achieved engineering acceptance as an approach to securing a system, as it contradicts the principle of simplicity. The National Institute of Standards and Technology (NIST) in the United States specifically recommends against this practice: "System security should not depend on the secrecy of the implementation or its components."
Generally speaking, it is a very poor approach to reasoning about a system's security. I do not see any security benefits that might be yielded by employing just one single endpoint, nor would omitting file extensions enhance the security of your web service. There may or may not exist benefits of omission in the realm of search engine optimization (SEO), and I think that may have been what was meant originally. I see even less SEO benefits for the one-page website, however, as pointed out by @Fiasco Labs. I don't market myself as an SEO guru (consult your local Digital Point forums).
The idea of using just a single endpoint may have spawned from today's increasingly common practice of delegating logic and routing to the client side while only serving out one page with static dependencies, and otherwise just performing session-authenticated database/long-term state operations in response to user interaction (see Meteor). Might the recommendation of omitting ".php" also have just been spawned from one person's distaste for that language in particular? I was not there.