Question: When it comes to password security there are things that people agree on like storing salted hashes of passwords, which gives a statistical defense against a compromised model and data.

What some don't seem to agree with are what to do with the salts. There are an infinite number of techniques you can do to try to protect the salts as well, but many experts will suggest that they are just pointless obfuscation of the security model, and that over time the model will be exposed, and I find myself disagreeing with this, but I may not be understanding the other viewpoint.

What I don't understand is if your model is compromised, why should you assume a full compromise instead of a partial? If your security model is distributed across different pieces of infrastructure which aren't equally secured, a partial compromise might not even be a problem. (If you do something like, say, encrypt the salt and retrieve the encryption-key from a more highly secured environment that is less likely to be compromised)

I'm assuming that a compromise isn't always 100% here. I've never had a system hacked nor have I ever hacked so I don't have the complete picture.

Answer: 
> 
> if your model is compromised, why should you assume a full compromise
>  instead of a partial? 
> 
> 
> 

You should always assume the worst case in security. This is the safest approach. 

> 
> a partial compromise might not even be a problem 
> 
> 
> 

Perhaps. But are you really sure?  

In your OP you are basing your analysis on too many assumptions. Perhaps in a very specific setup your evaluation that a partial compromise might not be a problem might be justifiable.  

But then again you assume that the attacker is not good enough to find a hole.  

Don't base your security model on assumptions.
Security through obscurity, is, at best, a gamble. Does it pay to store the salt somewhere else? Probably. But you have to look at the cost versus reward when you start getting into these multi-step security setups. I would say, if your application requires it, you will know it. Otherwise, adding more steps into the application for the sake of having super intense security may only give yourself headaches when things go wrong. Not everyone needs NASA level security for their systems. That isn't to say security isn't important. It's just that you need to temper it to your current environment.