PasswortPassword rotation policies are in place to reduce specific risks which allow an attacker to get (and use) the usersuser’s password. These risks are password reuse, credential phishing or other forms of social attacks to get the password, compromise of a server and thus access to the hashed passwords or brute forcing.
None of these risks really apply for physical locks in the same severity as for passwords, i.e. there is no reuse of the same (strong) key for other places, no remote credential stealing using phishing, no common compromise of a central server to access all the keys and no practical brute force attacks.
Loss or stealing a key is still possible but much different from a phished key since the person is no longer in access of the key. Cloning of a key requires temporarilytemporary physical access to the key and thus is much harder to go undetected. And in all cases the use of the key requires physical access to the specific lock and cannot be done from remote or from somewhere in the local network.
In other wordsIn other words: theThe risks with physical keys are different and the usefulness of key rotation is much less than with password. Additionally the costs of such risk mitigation is different: notNot only is key rotation much less useful with physical locks but is far more expensive to implement, since locks would have to replaced and keys have to be physically distributed.
Therefore the risks with physical keys are best contained in different ways, like having hard to clone keys or having cameras on the most sensitive locks to monitor who is opening the lock. Moreover physical locks and keys might have additional risks which passwords don't have, like being vulnerable to (often easy) lock picking without the need of the original key. Rotation would not really protect against these new risks anyway.
