They don't

There's a lot of bad advice on secret storage that is Not Based On A Threat Model™