Among the six installations I have access to there's one that was apparently compromised by Shoplift. This is the only one that has a standard
/admin backend url.
After patching all of them and reading many resources I guess that a site isn't vulnerable to Shoplift if the attacker doesn't know the admin URL - which corresponds just fine to the observation.
Still not fully convinced - especially after reading the full story by CheckPoint -, though, so: is it?
The - at least at first sight - uncompromised sites are on shared hosting without shell access so any deeper investigation will be pretty expensive. Hence knowing that the attack has no impact without knowledge of the admin URL would be a huge life(/time) saver.
PS: $this->question is ! about (security by obscurity || the possibility of brute forcing the admin URL).