You're right, it's not a problem for account.bbc.com, which off the back off your parent comment I've raised pull requests to get HSTS added. To answer why that subdomain exists: firstly cookie compartmentalisation allows us to set particularly sensitive cookies off to a separate domain, as well as allowing us to do different arrangements for traffic management separate from www.
HSTS is not something you can realistically implement until every path under the domain can be served via HTTPS. For the BBC this is problematic because there are hundreds of products and inter-dependencies under the bbc.co.uk/bbc.com endpoints. The amount of work required to do this is non-trivial, and not something that can be done in blanket - each product needs to test their product, its dependencies etc. There's also other issues like CDN endpoints (and the BBC uses several providers, including its own CDN), a relatively large and complex traffic management set up and the politics that comes with a relatively large organisation running a very big website.
That's all in the background, whereas what I described is the main plot. The movie tries to make a point against testing, but the main plot rather wrecks it.
AWS keys are already being detected and the account owners get notified when they are found. Private key material was a bigger issue at one point in time (i.e dotfiles/.ssh/id_rsa).
