App secrets are related to the "Web Server Auth Flow" (notably OAuth2), which is how one server authenticates to the other that is is allowed to access the resources that server provides. You can think of it as an "authorization password," where the password allows the calling service access to the service being called.
Mobile clients must not be trusted, and should never use an app secret; this is an inherent security risk, as it can allow a malicious app access to the service. Once an app secret is out in the wild, the service needs to have it changed to prevent malicious apps from abusing the service on behalf of users.
Note that you can't use replay attacks with OAuth2 because it uses a random number to salt each transaction, although the decompilation issue is still very much a factor. In fact, there have been articles written about the extreme number of Android apps that are vulnerable because of app secrets being leaked.
Once you have an app secret, you can emulate the app that the secret key corresponds to, and you can't tell the difference between an authorized, published app, and a malicious clone. Many developers don't understand that the app secret is the equivalent of a password or a private encryption key, and should be treated as such.
Mobile clients and other untrusted apps (web browser-based apps) should use the "user client auth flow", in which only the app key is used.