Why does default.settings.php suggest writing the value of the hash salt in an external file? The default.settings.php file contains the following comment:


  For enhanced security, you may set this variable to the contents of a file outside your document root; you should also ensure that this file is not stored with backups of your database.
  
  Example:

$settings['hash_salt'] = file_get_contents('/home/example/salt.txt');



Assuming the attacker was able to create a PHP file inside my Drupal installation, in which way does writing the hash salt in a file increases the security? In any case, the attacker would be able to read the value for $settings['hash_salt']. Eventually, the attacker could change the value for $settings['hash_salt'], but does doing this make any sense for the attackers to do?
The main reason to do this is to prevent the salt from accidentally being committed to your content versioning system.

Most advanced hosting environments (both Drupal hosts and all-in-one Drupal stacks) provide ways to do this.

Similarly, it is useful to go through the trouble of abstracting DB settings and the like, both for security and to make it easier to move your code from one environment to the next.