Oh, another argument is that sometimes the attacker gets to your DB at time t1, and your codebase at time t2, and if you have a system that changes your pepper regularly the t1 may be out of sync at t2.
All in all, it seems like a lot of work (that could be spent elsewhere) for little gain. I've been burned enough to know that any tweaks to a crypto system to "make it better" sometimes shoot you in the foot instead.
Salt is not hidden, if you get the passwords, you get the salt
But then you might suspect user X is using a weak password (that you know)
Then you use that to bruteforce the pepper (a defence would be to have a big pepper)
Or you know, if you already got in and got the password hashes it shouldn't be too difficult to get the source code/config info.