Totally.

Port knocking is one of those “of course someone did that” things to me too. A replay attack is enough to make it security theater.

An IP allowlist is a more useful addon.