The threat is accidental disclosure of transient secrets used in cryptographic applications. There are several ways that could manifest, e.g. "Heartbleed".
The goal is defense in depth. Yes, there are a million other ways to achieve defense in depth, like isolating this code in a separate process, a hardware device, etc. I consider those mechanisms also nice to have and am also working on Rust on a hardware device for key storage as it were.
However, I consider those mechanisms orthogonal and complementary to something like #[sensitive]. If it's possible to zero data left over from a stack containing transient secrets, I think it should be done.
Also note that this sort of zeroization is a requirement for certain types of high assurance cryptography certifications.