I guess it depends, if it’s a secret in use for the image, an attacker might use it to attack a pulled instance if the user deploying it didn’t change the secret. Kind of like an unchanged initial password.