Environment variables are hidden state. It makes them rather dangerous from a security POV (even more so than a root-modifiable configuration file, since it is less well-defined who can set an environment variable that will be inherited by some process).

As long as the solution that is decided on isn't part of vanilla Python, I care a bit less, of course :-)