At least in that case, if the account is compromised we definitely didn't leak the credentials. That we don't have them to leak is one of the advantages of key-based auth.

[of course not having the credentials to leak does not protect us from this sort of bug, it is just one factor in a multipart security stance]