There are a few reasons why this isn't common, from my experience. This isn't an exhaustive list, but here are a couple:
- Separation of Concerns - Embedding secrets in your binary complicates key management and environment configuration. Ex: if you need to rotate a key, you’d have to rebuild and redeploy the binary. Similarly, managing different environments (dev/stg/prd) becomes difficult, as you'd need separate binaries for each, with their respective secrets embedded. Keeping secrets external allows for easier updates and environment separation without touching your app code.
- Security Risks - If someone gains access to your binary, they can potentially use it to interact with your systems directly, without needing to hunt for or extract the embedded secrets.