[bombcar]

This is where risk assessment comes into play - people often consider it "evaluate the attackers and how to prevent them" but risks include many things; hardware failures, memory failures, human memory failures, etc.

And one of the biggest risks with encryption is data loss if passphrase are forgotten - using encryption usually involves considering that data loss is better than data exposure - which is obviously true for things like passwords (you'd rather forget your bank's password than have it exposed, because you can reset it) but not necessarily true for other data.

This can lead to things like encrypted systems but storing the off-site backups unencrypted because they're off-line and the only real risk is theft. Again, depends on what the data is.