Yes, BackendId is used to identify to which Backend instance the application is talking to. 
And BackendSecret is used to authorize data access level for the client application, in situations where there doesn't yet exist a End-User authenticated session.

So when Backend is hosting sensitive data, it should be protected by requiring the End-Users to login into system (via the app itself and using Enginio APIs).

We have also been considering adding support 3rd party elements authenticating the client (perhaps in form of OAuth) but it wouldn't completely solve problem, because the 3rd party API (from where the client requests it's authorization or fetches the secret token) can be again reverse engineered and exploited.