The main idea of using secrets is to reduce exposure and make it more secure. It was specifically designed for this. As per documentation:

• The data in the secrets is encoded (base64)
• Secrets can only be referenced from the same namespace
• A secret is only sent to a node if a pod on that node requires it. It is stored into a tmpfs and not written to disk. Once the pod that is using the secret is gone, kubelet will delete its local copy of the secret on that node.
• You can set access rights (e.g 644)
• If there are several secrets for several pods on the same node, one pod will not have access to the secrets of another pod, only the one that it asks for