I brought up the problem with a hard-coded encryption key where I used to work (the same key was shipped to every client site for data encryption). The problem was basically swept under the rug -- kind of the same scenario you ran into, claiming 'only people who knew the problem would be a risk'.

Eventually they hired Microsoft to bring in their project analysis team and the hard-coded key became problem #1! Fortunately for me, I'd learned long before that 'I told you so' never goes over well in the workplace -- I kept my sense of smug satisfaction to myself.