Almost never through broken cryptography. Nearly always through ordinary human plumbing:
A password pasted into chat, where it stays searchable for years.
A .env file accidentally committed to git, and still in the history after you "delete" it.
A credential emailed to a new hire, then forwarded, then in three inboxes.
Someone leaves, and nobody knows which of the forty credentials they had.
A key that was meant to be temporary and is now load-bearing in production.
A secrets manager's real job is to make the boring path (ask for it, get it, use it) easier than the leaky path. If the tool is annoying, people go back to chat.