Anyone have details, theories, or a book on how such inefficiencies come about? I can't speak to tech-oriented large orgs but I've worked with others and its just... I'm not shocked at all. I've seen public facing API keys in HTML, private SSH keys that do god knows what in plaintext on FTP servers... I just don't understand how they seem to care so much but in reality, care so little. Just lazy?
Not lazy, just overburdened by more important things.
At larger orgs, I notice they take it "seriously" but that results in people finding creative loopholes... like pasting in all the important production keys/passwords into a google doc and sharing the google doc because they "can't send secrets over slack" ... lol
The building has multiple methods of access at different stages. During the course of doing your job, you don't follow the proper protocols a few times. You closed a door without re-entering a lock code. You didn't check someone's badge and ID at the third floor access gate. You forgot to make sure someone swiped out on exit.
Nobody actually trained you on any of those protocols; they just made you watch a "security is everyone's responsibility" video and then expected you to know all the protocols. Maybe once or twice you were lazy, but it's equally likely you just didn't know what to do. And once you make that mistake, somebody can exploit it as long as you don't follow the protocol.
In facilities where security is important, there are safeguards. Doors left open sound an alarm, automatically lock when closed, and sensors detect if more than one person walks through without badging in. These safeguards exist because people are fallible and need help to enforce security. Companies without security safeguards either don't care, or are ignorant.
Also basic security knowledge isn't screened for in hiring nor is it really taught in most orgs (aside from trainings that people skip or optional stuff).
[0] https://www.goodreads.com/book/show/583785.The_Systems_Bible
As another commenter said, though, this is not the case in regulated industries, in the parts of those companies dealing with regulated processes, controls and data access.
I bet someone made a security key because it was the right thing to do but they didn't have the controls in place to manage it in their build system and give another key to developers/engineers/etc. So someone else copied it for convivence rather than have to explain to every moron in the whole company how to use it to access the database or run their monolith tests or get access from the dude that no longer works there who was the "giver" of access keys.