Since all non production sites should be protected by HTTP Authentication and not searchable for search engines we need to have some easy way to set it.
Some environments provides such functionality like pantheon or platform.sh but not all.
Using module is convenient for developers and do not need to think which environment will be used.
https://www.drupal.org/project/shield - easy to configure:
$config['shield.settings']['user'] = 'user';
$config['shield.settings']['pass'] = 'supperpass';