> You should not expect a service which has been exposed to the open internet to be hidden.

Of course not, but CT dramatically lowers the bar for attackers. That's what I mean.

It doesn't really, only when you need to hide subdomains for security reasons. Which you shouldn't do.

CT raises the bar for attackers since they will be logged into the CT if they try to MitM.

Any other attack is not made easier than without CT.