I'd guess it's not so much "a secret" rather than a natural limitation or just a "put a big number there that should be enough for everybody" (until it isn't)
Maybe it isn't intentionally a secret, but it should be documented. If you take the time to code a hard user limit (with its own API exception code, etc), you can take the time to mention it in the docs.