I know projects that do or did put their production database credentials, which had full read and write access, in git.

And no, thats not a clever thing to do, neither is there a good reason to do it. But people do things you do not like and theres little you can do about it.

I would like to live in a world where you were right, but I am not. Sadly.

[Edit] dumps though are another thing. Not seen that, yet.