It is technically impossible to embed a "secret" into something you allow everyone to download, and expect it to stay secret forever. This is called security through obscurity and it isn't real security.

This I know. What keeps me employed is knowing how to construct a client that doesn't embed a secret yet manages to perform an authorization flow.

This is in-fact the precise use case of secure enclave remote attestation. Maybe the GCHQ will be able to run their own Reddit clients, but the average person or even experienced hacker will not.