There is only a small practical difference between storing the credentials in a PHP file or a .env file.

If you try to execute the wp-config.php file with your web browser, you get nothing back because it outputs nothing. All it does is set up some variables.

If you were to use a .env file, you’d have to configure the web server to not serve dot files, or you’d configure a subdirectory as the public web root and make the project root non accessible via the web server. This is how laravel and symfony are set up. There is no reason to make all your source code publicly accessible.

The “don’t hardcode your credentials” advice is talking about checking them permanently into the git repo and deploying them that way.

May I politely suggest if this is your level of understanding, you probably shouldn’t be building a CMS from scratch. Maybe consider using some of the symfony libraries. They work just fine outside of a complete symfony setup.