The root cause of the 2019 Capital One breach was IAM credential theft through the EC2 IMDS (Instance Metadata Service). But before that, the common cause of the countless credential-exposure incidents companies suffered was far simpler — the password was written in plaintext in the source code. Something like DB_PASS: mysecretpassword under env.variables. Blocking this problem structurally is the reason env.secrets-manager and env.parameter-store exist.
Secret management is not only a question of "where do you store it." "Who fetches it and when," "what happens when the key changes," and "how much do you pay" are all design decisions