Disclaimer: yes, I have checked the Which HTTP status codes are interesting from a security point of view? which sounds relevant but not entirely.
These days it's supposed to be a good practice to not disclose extra data for non-authenticated users. Eg: email addresses for "forgot password" feature: when instead of saying "this email is not registered" hence disclosing that a user is not there/or is there you always return the same message like "check your email with the password reset link".
So far so good.
But what about HTTP status codes, more detail: for 404 vs 403.
Say you have some secured area where multiple people have different access to. Say it's a user management for multiple organisations.
And if you have a sequence based primary key for users that is used in the link to user's profile, eg:
/admin/users/42 then you might iterate over the counter and comparing the status response code 404 - for non existing, 403 for existing determine how many users are there.
It's a simple example and I think there are a lot of similar things around.
So the question: should we prefer security over semantics and use only 403 (or 404) exclusively in all cases?