You're sending your knock over the public network in the clear. It's observable by anything in the path. And then you're not the only one that can find the keyhole.
Entirely true, it's not true security, same as changing the ssh port. So, relying on it for any security is not useful but it's a good deterrent from automated scans that are not targeted towards you. Defense in depth means not necessarily discarding flawed defenses if they are in addition to proper defense.
It would be idiotic to use the knock as the only authentication, which is why I don't.
To be quite honest, I just like the aesthetics of it.