I imagine this is is rated low, even if you disable the banner at a login or change your HTTP responses to now show or lie about the web server, there is still lots of activities that can be performed to fingerprint the server based on traffic, error messages, file types being served, other services on the network. etc.