No it isn't.

Your local .env should NOT be shared, but should also be assumed to be leaked at any given time. Security should be done using a secrets manager through the cloud platform that's being used, e.g. AWS'secrets manager (or ssm param store too i guess)

Pasting it into chatgpt should not be a problem.

It also doesn't belong in git repos, but a much bigger issue is what process led to it. It's pretty standard to ignore it in a .gitignore, I'd be very surprised if modern agents made that mistake. And even if they did, agents should call tools that scaffold deterministically so that this isn't a problem.

I genuinely don't even know what we're talking about anymore, .env files are just values (it even says so in the article). People are making it way more complicated than it needs to be for no discernable reason other than an insane amount of laziness.