What is the actual difference between security through obscurity and true encryption? In an abstract sense, aren't both the same?

Don't their definitions boil down to the following?


security through obscurity:
trying to make sure some information cannot be obtained without knowing the secret method
encryption:
trying to make sure some information cannot be obtained without knowing the secret key


That secret method of STO is, in an abstract meaning, just a key.

So, is the actual difference that in encryption the connection between the key and the information is mathematically sound while STO uses something so abstract that attempting to describe it mathematically is not feasible and its security basically relies on that?
We often mock "security through obscurity", but it is not without value, especially in today's web environment.

Most attacks today are statistical in nature:  a virus attempts to infect 10,000 computers by blasting out random attacks.  If it infects even two more computers out of those 10,000, it has achieved its goal.  

Those viruses are aggressive in volume, not precision.  They don't all do a port scan, analyze the responses to determine OS version, they don't do a vulnerability assessment, then launch a precise attack the way a human would.  Instead, they try to exploit a common weakness - a buffer overrun exploit in PHP, or SQL injection vulnerability in a Wordpress plugin.  Anything the system administrator does to alter their defaults:  changing the base URL from "index.html" to "index.htm", or changing the database names in MySQL, might keep a particular automated attack from harming his system.  It doesn't remove the vulnerability, it merely changes it so that an attack relying on the defaults will not succeed.  

Will this keep out a determined attacker?  Of course not.  But it will reduce the number of low-level threats that can still surprise anyone if they exploit a 0day vulnerability.  And those low-level threats can quickly escalate to be every bit as damaging as an Advanced Persistent Threat.

That's why obscurity, which I define here as to be "any implementation settings changed from the default", still improves your overall security picture.  It may only reduce a few particular attacks, or delay them by a few days, but those days can be enough to get a real patch installed.  In practice, preventing a threat from becoming a successful attack is the true job of security, regardless of whether it was based on bad theory.