A ton of people don’t ever rotate their DKIM keys. If you’re not using email tooling that handles it automatically on a regular basis it’s an easy thing to do since it doesn’t expire like an SSL cert.

Anybody gets their hands on the private key, ex employee, compromised via hack, etc then everything will sail through.