Assume that secrets are going to be leaked or discovered and change them regularly. Everything else is a delay tactic, people mess up (or get tricked into messing up).
If you change them too often then it's a maintenance problem. You might even take an outage because you have mismatched credentials (i.e. application or database had the database credentials updated but the other one didn't)
Changing them regularly IS necessary. So if you're going to do it you should use a credential service like Hashicorp Vault.