Yes exactly. Sunshine is the best disinfectant.

Unfortunately, it can take a very long time for the organisation in question to be exposed and then reformed. Just look at the child-abuse within pretty much every organisation that had access to children. However, that doesn’t make the fight fruitless; organisations can be reformed and it’s worth it for society as a whole.

We just need much much stronger whistleblower protections.

Security through obscurity is how pretty much all cybersecurity security works on practice. There are a few publicly known primitives but organizations trusted with implementing actual security systems will go to great lengths to prevent anyone finding out which of them are used and in what way.

I disagree, it is an extremely strong strategy. You shut them up, they cannot inflict any more damage. The public can speculate what other secrets exist, but they can't know as they would if the whistleblower was kept around. The short-term negative publicity is tiny compared to the fallout if more information was leaked. This is why organizations basically always move to silence: It works.