[sixplusone]

As one small data point:

I've been running this experiment (another comment). While bots continuously hammer on port 22 (ssh), and repeatedly try to get things like /wp-* (I don't even run PHP), they don't bother fetching robots.txt in the first place, and my honeypot hasn't a single hit.

Definitely do not try to "secure" your site this way, but bots are either not sophisticated enough to analyze the .txt, or it might already be a known technique. Seems many other commenters come up with the same idea.

[mjbmitch]

If you're an adversary trying to snoop on port 22, why would you bother to respect the conventions of robot.txt to begin with?

[sixplusone]

Not necessarily the same bot. And they're not snooping so much as brute-forcing default/common/random(?) usernames & passwords.