How sensitive is a site's UUID?
Sorry, only after I created the question it came to my mind that the UUID itself already may be present inside a config YAML. And indeed it is. Inside system.site.yml. So, I guess when it's OK to have it printed inside a config YAML – with the purpose to get version tracked – it's no problem to have it inside a text file as well.