In addition to what others have said, having a secrets management system like this makes re-keying easier in the event of a compromise. If one app is compromise

In addition to what others have said, having a secrets management system like this makes re-keying easier in the event of a compromise. If one app is compromised, you can easily update the DB keys without having to recompile/redeploy every app that uses the DB. You would still have to redeploy the compromised app to change its keys for accessing the secrets management service, though.