Wouldn’t the owner of the hardware have root access to the secrets.json file?

I may be misunderstanding

How is that better than environmental variables?