Ask HN: Why do web servers still reveal their type and version in headers?

Isn't that inviting bad actors to scour the web for servers with just the right vulnerability? What's to gain by revealing that?