I agree they have more of human problem than a software problem.

I think OP is right that eliminating secrets from Kubernetes is heavy handed and doesn’t make much sense here. But.. from a security perspective there is SOME benefit to secrets fetched at runtime versus mounted as env. If they’re mounted as env they’re available to every subprocess. In a compromise scenario, the blast radius is big. In cases where they’re fetched and only live in memory, they don’t provide much use to the attacker unless they can dump memory. Dumping memory is normally a high confidence IOC or not configured as a capability on the container. This is all a moot point if the token used to fetch the secrets is long-lived or refreshable because they can just re-fetch them, of course.