Don't forget the cost of the IMP itself was just the beginning.  The fees to 'TPC' for the 1/2 duplex 9600 serial lines in those days were very, very expensive.   DARPA paid for them for each site in a large deal it had with AT&T.    I don't remember where I saw it, but what sticks out in my mind for those days was that cost of a site (host) on the ARPAnet was approx $125K / year per host in an ARPA grant. 

Which really explains 'security.' In practice nobody was going to risk letting just anyone hack their system so much that it put the site at risk.   Truth is we did not try to break in because we all had access, but if it you needed a $.5-2M PDP-10 to connect to the internet, a free IMP slot (each IMP supplied 4) and the leases on the wires.  So it was just not practical to think like we do today, much less act that way.

It was not so much security by obscurity, as security by practical economics.  Moore's law, Ethernet and cheap processing power is what blow that up.