Consider a scenario where Alice wants to send a qubit $\ket{\psi}$ to Bob over a quantum channel that is possibly being monitored by and eavesdropper, Eve.
Suppose Alice and Bob share a classical secret key $k\in\{0,1\}$, and Alice tries to encrypt the state $\ket{\psi}$ by sending Bob the state $X^k\ket{\psi}$. This approach is highly insecure because there are certain states whose encryptions can be perfectly distinguished by Eve. For instance, consider the states
\[
\ket{\psi_0}=\frac{1}{\sqrt{2}}(\ket{0}+\ket{1}),
\ket{\psi_1}=\frac{1}{\sqrt{2}}(\ket{0}-\ket{1}).
\]
which both happen to be eigenstates of $X$ with eigenvalues $+1$ and $-1$, respectively.
Then the two possible ways this state can be be encrypted are given by
\[\begin{align*}
X^0\ket{\psi_0}=\ket{\psi_0},
X^1\ket{\psi_0}=\ket{\psi_0},
X^0\ket{\psi_1}=\ket{\psi_1},
X^1\ket{\psi_1}=-\ket{\psi_0}.
\end{align*}\]
Regardless of how either of these states are encrypted, for $k\in\{0,1\}$,
\[
\bra{\psi_0}X^k\ket{\psi_1}=(-1)^k\bra{\psi_0}\ket{\psi_1}=0,
\]
which shows that the two states always remain orthogonal and can be distinguished with perfect accuracy.
Suppose that Alice and Bob have two independently generated key bits $k_1, k_2$ and Alice encrypts $\ket{\psi}$ as $Z^{k_1}X^{k_2}\ket{\psi}$. Note that Bob can decrypt this state since it is being assumed that he knows the key bits $k_1, k_2$. Consider any two arbitrary qubit states
\[
\ket{\psi_0}=\alpha_0\ket{0}+\beta_0\ket{1} \ \ \text{and} \ \ \ket{\psi_1}=\alpha_1\ket{0}+\beta_1\ket{1}.
\]
Then the density operators of these two states will be of the form
\[
\rho_j=\ket{\psi_j}\bra{\psi_j}=\begin{pmatrix}
\alpha_j\overline{\alpha_j}&\alpha_j\overline{\beta_j} \\
\beta_j\overline{\alpha_j}&\beta_j\overline{\beta_j}
\end{pmatrix}.
\]
The encrypted state $Z^{k_1}X^{k_2}\ket{\psi_j}$ can be described as a general quantum operation $\Phi$ with four Krauss operators, one for each possible combination key bits $(k_1,k_2)$, given by
\[
\Phi(\rho_j)=\SUM{k_1,k_2=0}{1}A_{k_1,k_2}\rho_jA_{k_1,k_2}^\dagger,
\]
where
\[
A_{k_1,k_2}=\frac{1}{2}Z^{k_1}X^{k_2}.
\]
Since $X^\dagger=X, Z^\dagger=Z$, and $X^2=Z^2=I$, it can be seen that $\Phi$ is indeed a valid quantum operation because the Krauss operators satisfy the completeness condition:
\[
\SUM{k_1,k_2=0}{1}A_{k_1,k_2}^\dagger A_{k_1,k_2}=\frac{1}{4}I+\frac{1}{4}X^\dagger X+\frac{1}{4}Z^\dagger Z+\frac{1}{4}X^\dagger Z^\dagger ZX = I
\]
The factor of $1/2$ is present in each $A_{k_1,k_2}$ so that each term in the sum contained in $\Phi$ occurs with equal probability since the key bits $k_1,k_2$ that specify how the state $\ket{\psi}$ is encoded are chosen with uniform probability.
The action of $\Phi$ on a general quantum state is given by
\[\begin{align*}
\Phi(\rho_j)&=\SUM{k_1,k_2=0}{1}A_{k_1,k_2}\rho_jA_{k_1,k_2}^\dagger \\
&= \frac{1}{4}\rho_j+\frac{1}{4}X\rho_jX^\dagger +\frac{1}{4}Z\rho_jZ^\dagger +\frac{1}{4}ZX\rho_jX^\dagger Z^\dagger \\
&=\frac{1}{4}\begin{pmatrix}
\alpha_j\overline{\alpha_j}&\alpha_j\overline{\beta_j} \\
\beta_j\overline{\alpha_j}&\beta_j\overline{\beta_j}
\end{pmatrix}
+
\frac{1}{4}\left(
\begin{array}{cc}
\beta _j \bar{\beta }_j & \beta _j \bar{\alpha }_j \\
\alpha _j \bar{\beta }_j & \alpha _j \bar{\alpha }_j \\
\end{array}
\right)
+
\frac{1}{4}\left(
\begin{array}{cc}
\alpha _j \bar{\alpha }_j & -\alpha _j \bar{\beta }_j \\
-\beta _j \bar{\alpha }_j & \beta _j \bar{\beta }_j \\
\end{array}
\right)
+
\frac{1}{4}\left(
\begin{array}{cc}
\beta _j \bar{\beta }_j & -\beta _j \bar{\alpha }_j \\
-\alpha _j \bar{\beta }_j & \alpha _j \bar{\alpha }_j \\
\end{array}
\right)\\
&=
\frac{1}{2}\left(
\begin{array}{cc}
\alpha _j \bar{\alpha }_j+ \beta _j \bar{\beta }_j & 0
\\
0 & \alpha _j \bar{\alpha }_j+ \beta _j \bar{\beta }_j
\\
\end{array}
\right)\\
&=
\frac{1}{2}\left(
\begin{array}{cc}
1 & 0
\\
0 & 1
\\
\end{array}
\right),
\end{align*}\]
since $\alpha _j \bar{\alpha }_j+ \beta _j \bar{\beta }_j=1$ because the states $\ket{\psi_j}$ are taken to be normalized. Therefore, $\Phi(\rho_j)$ is the maximally mixed state. Moreover, it can be seen that $\Phi(\rho_j)$ does not depend on $j$ and thus not on any particular state $\ket{\psi}$ that is encoded by $Z^{k_1}X^{k_2}$$\ket{\psi}$. This implies that it is impossible to distinguish between any of the encrypted states $\ket{\psi_0}$ and $\ket{\psi_1}$, since any measurement of $\Phi(\rho_j)$ will only yield one of the computational basis states with equal probability.
Suppose Alice and Bob share a classical secret key $k\in\{0,1\}$, and Alice tries to encrypt the state $\ket{\psi}$ by sending Bob the state $X^k\ket{\psi}$. This approach is highly insecure because there are certain states whose encryptions can be perfectly distinguished by Eve. For instance, consider the states
\[
\ket{\psi_0}=\frac{1}{\sqrt{2}}(\ket{0}+\ket{1}),
\ket{\psi_1}=\frac{1}{\sqrt{2}}(\ket{0}-\ket{1}).
\]
which both happen to be eigenstates of $X$ with eigenvalues $+1$ and $-1$, respectively.
Then the two possible ways this state can be be encrypted are given by
\[\begin{align*}
X^0\ket{\psi_0}=\ket{\psi_0},
X^1\ket{\psi_0}=\ket{\psi_0},
X^0\ket{\psi_1}=\ket{\psi_1},
X^1\ket{\psi_1}=-\ket{\psi_0}.
\end{align*}\]
Regardless of how either of these states are encrypted, for $k\in\{0,1\}$,
\[
\bra{\psi_0}X^k\ket{\psi_1}=(-1)^k\bra{\psi_0}\ket{\psi_1}=0,
\]
which shows that the two states always remain orthogonal and can be distinguished with perfect accuracy.
Suppose that Alice and Bob have two independently generated key bits $k_1, k_2$ and Alice encrypts $\ket{\psi}$ as $Z^{k_1}X^{k_2}\ket{\psi}$. Note that Bob can decrypt this state since it is being assumed that he knows the key bits $k_1, k_2$. Consider any two arbitrary qubit states
\[
\ket{\psi_0}=\alpha_0\ket{0}+\beta_0\ket{1} \ \ \text{and} \ \ \ket{\psi_1}=\alpha_1\ket{0}+\beta_1\ket{1}.
\]
Then the density operators of these two states will be of the form
\[
\rho_j=\ket{\psi_j}\bra{\psi_j}=\begin{pmatrix}
\alpha_j\overline{\alpha_j}&\alpha_j\overline{\beta_j} \\
\beta_j\overline{\alpha_j}&\beta_j\overline{\beta_j}
\end{pmatrix}.
\]
The encrypted state $Z^{k_1}X^{k_2}\ket{\psi_j}$ can be described as a general quantum operation $\Phi$ with four Krauss operators, one for each possible combination key bits $(k_1,k_2)$, given by
\[
\Phi(\rho_j)=\SUM{k_1,k_2=0}{1}A_{k_1,k_2}\rho_jA_{k_1,k_2}^\dagger,
\]
where
\[
A_{k_1,k_2}=\frac{1}{2}Z^{k_1}X^{k_2}.
\]
Since $X^\dagger=X, Z^\dagger=Z$, and $X^2=Z^2=I$, it can be seen that $\Phi$ is indeed a valid quantum operation because the Krauss operators satisfy the completeness condition:
\[
\SUM{k_1,k_2=0}{1}A_{k_1,k_2}^\dagger A_{k_1,k_2}=\frac{1}{4}I+\frac{1}{4}X^\dagger X+\frac{1}{4}Z^\dagger Z+\frac{1}{4}X^\dagger Z^\dagger ZX = I
\]
The factor of $1/2$ is present in each $A_{k_1,k_2}$ so that each term in the sum contained in $\Phi$ occurs with equal probability since the key bits $k_1,k_2$ that specify how the state $\ket{\psi}$ is encoded are chosen with uniform probability.
The action of $\Phi$ on a general quantum state is given by
\[\begin{align*}
\Phi(\rho_j)&=\SUM{k_1,k_2=0}{1}A_{k_1,k_2}\rho_jA_{k_1,k_2}^\dagger \\
&= \frac{1}{4}\rho_j+\frac{1}{4}X\rho_jX^\dagger +\frac{1}{4}Z\rho_jZ^\dagger +\frac{1}{4}ZX\rho_jX^\dagger Z^\dagger \\
&=\frac{1}{4}\begin{pmatrix}
\alpha_j\overline{\alpha_j}&\alpha_j\overline{\beta_j} \\
\beta_j\overline{\alpha_j}&\beta_j\overline{\beta_j}
\end{pmatrix}
+
\frac{1}{4}\left(
\begin{array}{cc}
\beta _j \bar{\beta }_j & \beta _j \bar{\alpha }_j \\
\alpha _j \bar{\beta }_j & \alpha _j \bar{\alpha }_j \\
\end{array}
\right)
+
\frac{1}{4}\left(
\begin{array}{cc}
\alpha _j \bar{\alpha }_j & -\alpha _j \bar{\beta }_j \\
-\beta _j \bar{\alpha }_j & \beta _j \bar{\beta }_j \\
\end{array}
\right)
+
\frac{1}{4}\left(
\begin{array}{cc}
\beta _j \bar{\beta }_j & -\beta _j \bar{\alpha }_j \\
-\alpha _j \bar{\beta }_j & \alpha _j \bar{\alpha }_j \\
\end{array}
\right)\\
&=
\frac{1}{2}\left(
\begin{array}{cc}
\alpha _j \bar{\alpha }_j+ \beta _j \bar{\beta }_j & 0
\\
0 & \alpha _j \bar{\alpha }_j+ \beta _j \bar{\beta }_j
\\
\end{array}
\right)\\
&=
\frac{1}{2}\left(
\begin{array}{cc}
1 & 0
\\
0 & 1
\\
\end{array}
\right),
\end{align*}\]
since $\alpha _j \bar{\alpha }_j+ \beta _j \bar{\beta }_j=1$ because the states $\ket{\psi_j}$ are taken to be normalized. Therefore, $\Phi(\rho_j)$ is the maximally mixed state. Moreover, it can be seen that $\Phi(\rho_j)$ does not depend on $j$ and thus not on any particular state $\ket{\psi}$ that is encoded by $Z^{k_1}X^{k_2}$$\ket{\psi}$. This implies that it is impossible to distinguish between any of the encrypted states $\ket{\psi_0}$ and $\ket{\psi_1}$, since any measurement of $\Phi(\rho_j)$ will only yield one of the computational basis states with equal probability.
