Fair point, but I personally wouldn't ever do that. There are well-known solutions to the problem: the user's cookie after authentication is not persisted on the server and only an ID is used (the key is derived from the password, otherwise this wouldn't ever work). Then another part of the cookie serves as an ephemeral key that the backend uses to decrypt and serve the personal data back (through HTTPS). Again, that second part of the cookie is never persisted on the server.

I am not asking anybody to take my word for it, just saying how my ethics and tech education tell me I should be doing things.