Rotation helps only if the credential is still tightly controlled and clearly owned. In practice, static credentials are often copied into scripts, reused by multiple systems, or left active longer than intended, so rotation changes the date on exposure rather than removing exposure. The risk is structural, not just procedural.