Rails and others mis-trained a generation of web devs to put credentials into a big environment file. This was always a bad idea, and even worse now that things like AWS credentials can be turned into cash so quickly.
In their defence, it wasn't as bad back then. They were created by/for small teams/sole practitioners with no separation of responsibility. Source control would be on-prem (or just local directory backups). The Java EE model with explicit separation between development and deployment as separate activities was a disliked, or not understood.