Has done "wat" for years?

I use sops for encrypting yaml files. But how does it replace .env or other ENV var setters/holders?

Sops can natively handle .env files. All you need to apply them to your process is a small wrapper script that sources the decrypted file before invoking your command.