I assume environment variables became popular as it's an 'easy' way to inject secrets without hardcoding them in a config file.