sure for some attacks it might help, but ultimately if someone has compromised your server, that server is likely to have the ability to load the key to decrypt

sure for some attacks it might help, but ultimately if someone has compromised your server, that server is likely to have the ability to load the key to decrypt the data. For example to handle the case of unattended server reboot, you'd be likely to have the server have a script to load the key back into memory. Attacker gets shell access, they get the script, they get the key... Security is always a trade-off and people tend not to engineer their webapps with the assumption that they'll be breached in specific ways.