[rndgermandude]

I'd say it's good enough. An adversary would need to know the file the secret is hidden inside, what method was used, probably would need the unaltered container file to compare with to extract the bits, and then has to overcome the additional layer of encryption.

I didn't check the code corresponding to the submitted article, but I'd guess it would be infeasible even for an advanced or even state adversarial actor to automatically check lots and lots of images (unless there is some kind of "signature" that can be detected) just in case there might be some LSB-based steganographically hidden secret inside.

If the adversary is doing a targeted attack against an individual/group of individuals, it might be more feasible, but then I'd wonder if other means of attack, including the good old monkey-wrench-to-the-knee aren't still more efficient.

[bawolff]

> unless there is some kind of "signature" that can be detected

There is.

You're right that the encryption probably can't be overcome. The risk is more that it is detected and then the adversary beats you up until you hand over the password.