Depends on the context and exposure. Sometimes a key under a rock is perfectly fine.

I used to work for a security company that REALLY oversold security risks to sell products.

The idea that someone was going to wardrive through your suburban neighborhood with a networked cluster of GPUs to crack your AES keys and run a MITM attack for web traffic is honestly pretty far fetched unless they are a nation-state actor.