I think you have some faulty assumptions. Environment variables are not usually disclosed because somebody got shell access. It's very common to print them out

I think you have some faulty assumptions. Environment variables are not usually disclosed because somebody got shell access. It's very common to print them out while debugging, but not common to print arbitrary files containing your credentials. I have yet to see phpinfo() print ~/.ssh/id_rsa to the world for example, but I sure have pulled a lot of passwords out of it.