Is it a good idea to keep user's principals in a dapp in secret?

In theory, yes, nodes can read canister state. This is a good post if you are looking to understand more about nodes and canister state: Guarding against malicious node providers - #2 by diegop

In the future, you could secure the data using VetKeys.