New security key for existing database
Not sure there is a definitive answer here. :) For the use-case you're concerned about, Craft uses the security key to encrypt/decrypt data in the database. In a stock Craft installation, that's for sensitive email settings.
Even then, with the advent of Project Config, that's not likely an issue anymore. Those settings will get stored in Project Config files, which hopefully are using environment variables to hide their values.
I'd guess that 99% of plugins aren't encrypting/decrypting sensitive info and the ones that are, are probably storing that info in Project Config, so it still wouldn't be a concern.