Of course, *_r is a better option, but the existing API is used so pervasively that it needs to be made thread-safe to actually avoid thread-unsafe code in, e.g, libraries.
- return a pointer - the library owns the allocation - the state is global and mutable
Thread safe
There are, however, other problems (discussed elsewhere in this thread) that complicate such an API in the context of getenv().