How do I properly update the WordPress database password?

This is technically challenging. WordPress must have access to your DB password in plain text. Having access to the wp-config.php contents is already a breach of security in progress.

There are alternate approaches to configuration, such as loading credentials via environment variables, but in practice they are used exceedingly rarely because PHP’s configuration file is a reasonable solution already.

It’s not clear why you assume someone will get access to the configuration file. As a low-hanging fruit, you can place it outside of the web accessible directory. WordPress will scan for the configuration file up one directory level above itself. For subdirectory installs, you could use require to load configuration content from elsewhere, but even that is rarely done.