Is there any security risk to use getenv() inside settings.php to populate databases variable from a .env file?
If the .env file is outside the server document root, using getenv() is similar to putting the hash salt in a file and reading it with file_get_contents() as the following comments in the default.settings.php file suggest to do. (The same comment is present in the default.settings.php file for Drupal 7, so it's not a matter of which Drupal version is used.)

/**
 * Salt for one-time login links, cancel links, form tokens, etc.
 *
 * This variable will be set to a random value by the installer. All one-time
 * login links will be invalidated if the value is changed. Note that if your
 * site is deployed on a cluster of web servers, you must ensure that this
 * variable has the same value on each server.
 *
 * For enhanced security, you may set this variable to the contents of a file
 * outside your document root; you should also ensure that this file is not
 * stored with backups of your database.
 *
 * Example:
 * @code
 *   $settings['hash_salt'] = file_get_contents('/home/example/salt.txt');
 * @endcode
 */
$settings['hash_salt'] = '';


If that is considered enhanced security, the same can be said for reading some values using getenv(), if the file containing the values of the environment variables is not in the server document root.

Keep in mind that, if somebody would be able to write a PHP file on the server, it would also be possible for them to read the environment variables and the file containing the hash salt.