It's security through obscurity more than defense in depth because the failure mode of the two firewalls in series is the same, as observed by other systems on the network. Defense in depth would better describe the situation that even if a firewall was compromised, standalone[1] web servers on the network would only allow communication to occur if they are first presented with a client TLS certificate that the firewall in all practical circumstances can never obtain[2].

There is a school of thought that by making the system ridiculously complex with dozens of ICT security products from multiple vendors, the hope is that an attacker would have nightmares about planning how to traverse the network without raising alarms. It is also a nightmare to manage an unnecessarily complex ICT system so the chance of getting caught traversing the complex network is possibly lower because no one truly understands if an alarm is significant or not and monitoring in general becomes much harder. Real alarms get lost amongst the noise and confusion of the situation.

[1] (meaning: not accessible to or managed by the same central systems as the firewalls)

[2] (example: clients cannot accept inbound connections from the firewall and certificate management is isolated from the network)