The default.settings.php file contains the following comment:
For enhanced security, you may set this variable to the contents of a file outside your document root; you should also ensure that this file is not stored with backups of your database.
$settings['hash_salt'] = file_get_contents('/home/example/salt.txt');
Assuming the attacker was able to create a PHP file inside my Drupal installation, in which way does writing the hash salt in a file increases the security? In any case, the attacker would be able to read the value for
$settings['hash_salt']. Eventually, the attacker could change the value for
$settings['hash_salt'], but does doing this make any sense for the attackers to do?