What is the best place to store app variables?

You should set the secret keys in Environment Variables.

If you set in app/Config/Constants.php or Controllers, all the people who can access the source code
can get the secret keys.

But won't the same hacker have access to the .env file?

If CI has been installed the correct way a .env file is just as save, the main difference is if the .env is publicly available it's readable PHP cannot be read by default (still possible with wrong configuration on server) it's processed.