[mindcrime]

Then they'll inadvertently upload it to e.g. GitHub or similar in some source code and bad guys have bots which will steal it then make use of your account for all kinds of evil purposes.

OK, yeah, that was the one scenario I was thinking about. I just didn't know if there was some other AWS hack being employed commonly.

For this, there is at least a solution, even if people don't use it, and that is to use IAM roles. Create your root account and never (or almost never) use it, except to create IAM users with more limited permissions, and then use the AIM user for all your day to day stuff.