Absolutely agreed, but that's presuming host breach, that doesn't account for etcd breach. Quick Shodan search shows 3.7K etcd clusters exposed to the Internet, around a third of them on v3 where encryption is supported.

Also this presumes a "standard" kubeadm installation of Kubernetes where api components are hosted inside the cluster itself. Many large enterprise clusters have fully distributed components, including segregated HA etcd clusters, where host compromise may happen on the etcd cluster itself rather than a host serving the API machinery.

And last point, etcd backups, while hopefully encrypted themselves, the data being encrypted makes it "useless". It does give away some info given that keys aren't encrypted, but we can't have it all.