For many companies this is a myth.

Once you reach a critical mass of complexity and scale, you figure out that simple database seed files you can bundle into an app repo are not sufficient to test your application.

So what solution do people look to? Taking data from prod and feeding it into lower environments. Depending on what regulation you are subject to, some amount of data scrubbing may be required. But even if it isn't, leaking users' data is a bad look.

Is data scrubbing easy to do perfectly? The answer is 100% unequivocally no.

You mentioned intranet too, and the thing about that is making dev services available externally is a common enough problem that Ngrok is financially viable.

TL;DR: the assertion that dev secrets are low value is often not true.