Let me clarify this (seemingly arbitrary) limitation of max 2 Client Secrets per Account.
The reasons why you can define more than one Client Secret per Account is to facilitate "Client Secret roll-over". For security reasons, Client Secrets have an expiration date and as soon as a Client Secret expires, it won't be accepted anymore (and thus you won't be able to log into the Account using Client Credentials).
Obviously, it won't be a good idea to await this disruption before generating (and using) a new Client Secret. At the same time, you don't want to simply replace an existing Client Secret with a new one before all the client code that uses it has been updated.
This is why you can (temporarily) generate a second one. You can do this well before the original Client Secret expires and you can already start using the new one, whilst the original one is also still accepted. When you're confident that the original Client Secret is no longer used, you can remove it and you're ready for the next roll-over in a few months.