Prod tends to have less privileges than CI/CD. CI/CD tends to be full admin, so it's far more sensitive. Prod tends to have tooling for detecting breaches, better logging, etc. People tend to use containers, which act as a sandbox.
Prod also won't be wormable the way that CI/CD is. With CI/CD I can own another dev, use their creds to push another malicious build script, etc. "Attacker is in my prod env" isn't wormable.
Yes, capabilities in prod would be hugely beneficial but removing CI/CD is massive as a win.
Wouldn't the dropper get executed once tests are run within CI though?
Yes, you should separate "tests execute" into their own unprivileged workflows that don't have "deploy" secrets.
You can also do the same for the build workflow, no?
Yep, I'd recommend it.
yeah, or when a dev starts the local development server (unless that server is containerized).
Dev laptops tend to have better monitoring than CI/CD so I still think this is a better option. You can also have devs use VMs or separate dev environments like an ec2 instance.
To be clear, just solving the CI/CD portion is insufficient, but it is a massive win.