Earlier quoted context omitted.
Most of the colleagues I've worked with only use "git add ." without checking first. Keys, npm directories and huge binaries are fixed by deleting them later on. The horror.
The problem is that those developers are also going to forget to update the ignore-by-default .gitignore to allow files, so there will be missing files. And they won't see any problems, because it works on their machine.
Not pushing a file has a much easier fix than pushing an API key. The damage is also very different.
Sure, both have failure modes but the effect of the failure is different and acting like they're the same isn't helpful to finding solutions