secrets don't belong in env vars, because many languages and/or frameworks will happily dump all your env vars to users in the event of misconfiguration or some errors.

I have literally never seen that happen. (Outside a core dump, which has a lot more than env var.)

You have any examples in mind?

It happens all the time, especially in security and quality assurance testing. It's less common in modern versions of tools and frameworks, but I routinely encounter these kinds of dumps when I am doing security testing work on anything enterprisey.

Django error pages with DEBUG=True.