Why is a Kubernetes Secret not actually 'encrypted' by default?

By default a Secret is only base64-ENCODED in etcd, not encrypted — base64 is trivially reversible by anyone with etcd read access or by running `kubectl get secret -o yaml` and decoding the output, so real protection requires enabling etcd encryption-at-rest or using an external secrets manager.