If you want to go down that path, a password is only security by obscurity.

Port knocking is an extra layer of security, and one that can stop attackers from ever knowing your private server even exits. A random scanner won’t even see any open ports.

Always bear in mind that any random guy advising people not to use port knocking msg be doing it with malicious intent. I’m sure there’s someone out there advising that random passwords are a waste of time, and everyone should just use monkey123.