I'm aware of multiple ways to store an encryption key, some very bad, such as in your codebase or elsewhere on the same server, and others much better such as where the encryption/decryption is done away from your application or is bound to specific hardware (e.g. with a H.S.M.).
It strikes me that whatever method is used, if an attacker gains access to your codebase, they can simple write a script that would decrypt and export the database.
Obviously, keeping them out of your server is very important, but am I missing something obvious in the scope of what's mentioned above?