I was just bitten by this. Even when the option to enable a secret for all private repos is disabled, there is an option to pick which repos a secret is for one by one, and private repos are shown there (and selectable). I assumed you still could pick private repos one by one if you can actually do it via the UI.
But then I also have the empty secret issue. If I go to the repo and define the same secret, I’m even told I’m overriding an organization secret, which I’m not apparently.
(another screenshot was here but apparently I can only embed one media since I’m a new user in the forums)
I understand the limitation but hopefully the UI can be improved to not offer enabling stuff that won’t work at all, it could save time and confusion to users