It's not security through obscurity. It makes it so that two things need to get breached to access the secrets: the application code and the stored secrets.