Why is settings.php in the web folder? In the default installation, settings.php is located at sites/default/. There are no recommendations in the official Drupal website about changing the location of this file. Doesn't it pose a potential problem of security? I have seen Apache webservers eventually failing to interpret PHP files, and serving the content of the PHP file in pure plain/text format, instead of the supposed HTML content. That would completely expose the database connection user and password, which is not even encrypted. Why does it work this way?
You are absolutely correct. I know for a fact that many developers/sysadmins do not take the risk that the PHP interpreter might fail at some point, and include the db password (and other sensitive data like API keys) from a file outside the webserver's docroot.

I'm surprised that this is not documented as a best practice anywhere - at least I couldn't find it on drupal.org either. I have no information why it works the way it does.