Does "Kerckhoff's principle" and the flaws of "security through obscurity" apply to IT security outside of cryptography?

So from what I've learned, it's a well established law of cryptography that the security of a cryptographic system shouldn't rely on an attacker's lack of knowledge about the how the system works and how it's implemented.

But is the same thing true for IT security in general. I mean realistically it definitely makes a targeted attack easier if the attacker has all the information about a company's IT infrastructure, which operating systems they run, which kernels, what security measurements and policies are in place, which mitigations have to be bypassed etc

I just can't imagine that there's a good argument for not keeping the details of IT systems a secret.