Is a public /admin route a security flaw?

It is not a security flaw to use a known admin URL. The things that should be secret are the management credentials, not the URL. It's like hiding a door, while really it's the key that you should keep secure.

You can protect the door better using human guards, a perimeter fence, extra secure lock, sturdy walls, etc. This should not give you a false sense of security: the lock should still be secure to let only authorized persons enter, but these measures can help.

Translating them to the digital world, you can put the admin panel behind an IP address whitelist (guards that check ID cards), have multi-factor authentication (extra secure lock), only allow connections through an internal management network interface (a fence), etc.

It slightly helps not to have a known/predictable URL, but this is mainly useful for common applications. If there are ten thousand WordPress websites out there and a security issue is found, then the first thing hacking groups do is send hack attempts to as many /wp-admin pages as possible (the standard WordPress admin URL). If you changed your URL to /wp-admin5839 then your site will not be hit in the first wave with untargeted attacks. Nevertheless, if someone means to hack specifically your site, odds are that they spent time guessing your admin page already or managed to figure it out some other way, and once the security issue becomes known, they will just use it on your hidden page before you have a chance to patch. So it doesn't help a lot, but it does help a little in some specific scenario.

It depends on the use-case of your application. If it's within an organization, you can restrict the admin panel to only respond to requests from a specific source IP. You can also use certificate-based authentication, which is more secure than traditional password-based authentication.

If you write some "general" software, such as Wordpress, you need to be sure that your software is usable for the vast majority of customers, ranging from an individual to a large organization. Therefore, making assumptions about the infrastructure of your customer will be difficult.

In general, it's not really a vulnerability in itself, but it's an unnecessary risk to expose it unless you have to.

Changing the route to the admin page may provide marginal defense against automated bots and script kiddies, since they probably don't have e.g. "/mysupercustomapp-admin/" in their directory wordlist. To me, it seems similar to the concept of changing your SSH port from the default of 22 so that it is missed by automated scans and random brute force attempts.

However, past that, I would almost say it's "security through obscurity" if you are truly relying on a hidden admin page as a protection. Unless it's a very long and hard to type URI path (poor usability), a determined attacker will be able to find it either by automated or manual means.

Instead, you should focus on securing your authentication in general. Enforce proper password strength, consider captchas and/or rate limiting authentication attempts, possibly require client certificates (if appropriate), implement 2FA, limit access to the admin page to trusted/internal IP addresses only, and consider account lockouts or temporary bans (allows for DoS as a trade-off).

TL;DR: There may be benefits to a non-standard admin page path if part of a defense in depth solution, but by no means should it be relied on.