It seems the most common issue of them all is an exposed .env file by that measure.

I think that is very likely to be common. It is an easy mistake to make if your code is in a directory the web server can read, which is common, and is usual with PHP.