django-encrypted-secrets | Encrypted secrets for Django applications | Encryption library

The reason it's considered safer is because you should have your settings file in git or some other VCS to have consistent development environments, but your secrets should be outside of it. This way, even developers don't have the production secrets if they don't need them.

It doesn't need any extra protection as long as you're careful about how you deploy your code, who can access the servers, etc.

Your question also asks about other methods, so...

You could encrypt it like you have there, but this will always require a master key that also needs securing somehow.

Another option is to use a text file on the server.

A good option if you want to encrypt the secrets is to store them encrypted in your continuous integration solution, which injects them into the environment at deploy time. Travis CI, GitHub Actions, more or less any CI solution can do this.

But in general, just keeping it out of VCS and limiting the access to the secrets is usually good enough.