I host some private stuff on mine, hidden behind an authentication service that is. But because I just use a wildcard no-one can really tell what I have hosted - the same login page occurs for every subdomain, regardless of whether it's actually wired up to something.
That doesn't help with services you wish to make semi-public (like a lemmy instance) though.
That's a very succinct rebuttal... I like it.