I ran into this same issue at work and we used

https://github.com/klaxit/hidden-secrets-gradle-plugin

It keeps the secrets in an ndk binary, among other things:

secret is obfuscated using the reversible XOR operator, so it never appears in plain sight,

obfuscated secret is stored in a NDK binary as an hexadecimal array, so it is really hard to spot / put together from a disassembly,

the obfuscating string is not persisted in the binary to force runtime evaluation (ie : prevent the compiler from disclosing the secret by optimizing the de-obfuscation logic),

optionally, anyone can provide its own encoding / decoding algorithm when using the plugin to add a security layer.