base64 is a costume, not a lock. Real protection is RBAC plus encryption at rest.

A Secret's values are only base64-encoded, an encoding anyone can reverse with a single command. Unless the cluster enables encryption at rest, they sit unencrypted in etcd as well. So the safety comes from controlling who can read the object, turning on encryption at rest, and possibly using an external secrets manager.

Read it once, then a question tests whether the trick stuck.