Q:

How are keys 'protected' by storing them in ENV variables?

I am confused about how Laravel protects keys using environment variables. It seems to me that a hacker could just look through the environment variables or at the hidden file. How is this better than storing it in the default array. Does Laravel do something with the environment variable to make this more secure? Or is it just a way to separate keys for different configurations.
I tried searching for an answer but I only found a non-Laravel question of the same nature that didn't seem to have a good answer either.

A:

The configuration file is not meant to be stored in source control. This means the sensitive data is never stored anywhere it does not need to be. If a hacker were to gain access to your repository, they wouldn't be able to access for example; your database password.
This configuration file will placed upon deployment or once manually (eg ssh) into the project for the application to access. 
Web server rewrites (apache .htaccess) or NGINX config will ensure that this configuration file can never be directly accessed.
If a hacker gets access to your server via an exploit or another method, they will still be able to access the configuration file.
Security is about having multiple layers, and removing this sensitive data from source control is one of many.
At the bottom of the configuration section in the laravel docs it mentions this very briefly:

Be sure to add the .env.local.php file to your .gitignore file. This
  will allow other developers on your team to create their own local
  environment configuration, as well as hide your sensitive
  configuration items from source control.
Now, on your production server, create a .env.php file in your project
  root that contains the corresponding values for your production
  environment. Like the .env.local.php file, the production .env.php
  file should never be included in source control.

