But what if your codebase is used in thousands of places that you don't control? You can't always change it.
The real lesson is - don't put passwords in your code.
The real lesson is - don't put passwords in your code.
It's like someone responding to the suggestion to "use strong/unique passwords" with "but what if I don't have any authentication?"