Except when they aren't. Defence in depth and zero trust and short expiry makes them way less useful for sure.

Startups are probably most vulnerable as they are likely to use more "pet" techniques for infra, like SSH open to any IP to make changes.