>So a breach occurs and they recommend people rotate keys? But they claim fraud and break everyone's access with existing keys?

That's what you do when you have a breach. What exactly did you expected? Keys continue to work and everybody gets a box of chocolates too?