Comment by makison

Exactly. Nginx/apache is not pointing to /public/ directory as root of the application/domain. That's why .env is accessible.