It is not a security flaw to use a known admin URL. The things that should be secret are the management credentials, not the URL. It's like hiding a door, while really it's the key that you should keep secure.
You can protect the door better using human guards, a perimeter fence, extra secure lock, sturdy walls, etc. This should not give you a false sense of security: the lock should still be secure to let only authorized persons enter, but these measures can help.
Translating them to the digital world, you can put the admin panel behind an IP address whitelist (guards that check ID cards), have multi-factor authentication (extra secure lock), only allow connections through an internal management network interface (a fence), etc.
It slightly helps not to have a known/predictable URL, but this is mainly useful for common applications. If there are ten thousand WordPress websites out there and a security issue is found, then the first thing hacking groups do is send hack attempts to as many /wp-admin
pages as possible (the standard WordPress admin URL). If you changed your URL to /wp-admin5839
then your site will not be hit in the first wave with untargeted attacks. Nevertheless, if someone means to hack specifically your site, odds are that they spent time guessing your admin page already or managed to figure it out some other way, and once the security issue becomes known, they will just use it on your hidden page before you have a chance to patch. So it doesn't help a lot, but it does help a little in some specific scenario.