What are the odds an attacker can get keys once but isn't able to steal them again after they're rotated? It makes more sense for user credentials that might h

What are the odds an attacker can get keys once but isn't able to steal them again after they're rotated? It makes more sense for user credentials that might have been phished but I'm not sure that converts directly to machine managed keys.