The fact that most software sucks is not exactly a secret. I'm not sure a "look how the sausage is made!! ZOMG!!" thing would surprise a lot of people.

In my experience, one of the most counterintuitive truths that (good) programmers understand is that security is, in most cases, the opposite of obscurity. It's really hard to explain to a non-programmer that the most secure system is the one that everyone understands perfectly.

I could go on... there are lots more. Like, the mythical man month is something most of us know about now. The deep relationship between randomness and compressibility. Cryptographic hashing. How a single number can be used to represent the answers to a set of yes-no questions. And so on.