Always Encrypt and SSIS - Security Risk
There are a few parts to implement proper security in your environment:


SSIS packages are encrypted by default when referring to sensitive information, you can set with their own password
SSIS can also be signed by a certificate 
There is a master key, that ideally would be in a KM outside the SQL Server
There is a database key
There is the user that you would use for running the package, which you should grant specific access and deny access to anything the package shouldn't touch


There is nothing that says you would have the keys on the same server; but even if you have them in the same server, it doesn't mean they would have the same security user. Best practice would be to have a separate KM server.