It does, but that opens up much more powerful tools to work with.

As an example of one such tool in practice, compare the task of "list all open file descriptors in an arbitrary Unix process" with "list all strings an arbitrary Unix process incorporates some knowledge of". One is a one-liner (`lsof -p <pid>`) and one is really tricky at best, and probably can't be done reliably.

Yes, but that's much less likely to happen accidentally/implicitly, whereas accidentally leaking secret strings into logs etc. is extremely common.

It's not a silver bullet, but it doesn't need to be to radically improve security in practice.