> Some generic SaaS company or tiny startup, yes, engineers should have root access to stuff.

Why? Setting up proper CI/CD is a 5 minute task. If you're worried about sharing keys with 3rd parties the pipeline can be self-hosted. There's no need for credentials to live on engineers' machines.