Most companies the size of WITCH do not utilize access keys nor add them to source control. While a developer may make a mistake, you would expect there would be guardrails around the development process, either by way of an automated scanner or a more experienced software engineer catching it as part of a code review. The fact that none of this happened is quite concerning, IMO.
You could also perhaps say this is a management problem than an employee problem; and while that is true, such distinctions are rarely made. As an example, I'm sure you've had bad experiences with customer support which you simply summarized as "The support rep at Corp X sucks" when talking to other people; whereas the truth might be somewhere closer to "The support rep was out of luck because they didn't have a process to do A, B and C because management didn't think of it."