Not specific to the railways.
I discovered a subsection of a certain social media platform dedicated to 'lift surfing' - they'll buy lift/elevator keys online, chuck them into service mode, climb up onto the service area on top of the lift and just ride it up and down.
I once worked in an office where two people had left and nobody had the key for their pedestal drawers. Estates/facilities said it would take them a month to get replacement keys. We kinda needed the drawers for the two people who replaced the ones who left though. For about £4 online I got the master key for all the office drawers (it was cheaper than buying the two specific keys).
Volunteering with another group we got donated some equipment which required a 'TOK1' or 'T0K1' key, I forget which. Ordered the TOK set of keys. Turns out, those keys also unlocked the security barrier to my work's car park, which was actually a sensitive working environment.
There's groups like Extinction Rebellion who bought display board/advertising board keys to replace posters. People who steal from vending machines with master keys, alarms, fire brigade equipment/access, forklifts, postboxes - all obtainable dead easy.
Obviously you expect things like train cab doors to be more difficult to obtain keys for than security barriers or lifts, but there's only so much you can do to protect keys when you use the same key/lock in literally thousands of places.