Firstly, I think it's a lot to ask that we believe Zyxel put a backdoor in their products and then just forgot about it. But even if we choose to believe that,

Firstly, I think it's a lot to ask that we believe Zyxel put a backdoor in their products and then just forgot about it. But even if we choose to believe that, it's not wrong to say that it was secret. "Secret" typically means "without the knowledge of others". If I forget the secret combination to my safe, it doesn't become "not a secret" because of that. In your example, Mozilla has presumably made public that they are using remote updates. So it can hardly be described as secret.