Or passed in a password as an argument to any programs? (e.g. mysql -uusername -ppassword -hprod.db.com)

Plus, if the commands are important as they appear to be (with the need to be referenced days or weeks later), assuming they don't contain passwords, why not put them into a protected team wiki (or a private Github Gist)?

As an attacker, your goal is to get the most amount of privilege and credentials in a brief amount of time without being detected while it's happening. So you grab .bash_history, .bashrc, .bash_profile, .aws/credentials, .ssh/config, .ssh/id_*, .ssh/known_hosts, .pgpass, .psql_history, .mysql_history, .gitconfig, and then get out before a second has even elasped.

As a target, your goal is to limit the blast radius as much as possible, and by following certain practices, if/when you are compromised you can accurately state what the attackers could or could not have had access to.

This isn't about being 100% hackproof, it's about limiting the damage when you are hacked.

You have already pwned the machine, what disabling history is gonna do to save someone's ass after that?

The hassle of not having a history file every day is a much bigger cost than having it on an already pwned machine, isn't it?

This is why most people don't listen to security experts, instead of educating people in a kind way and making the world more secure most of you like to just point out how bad we are.

With the history file already there, you don't have to wait for it to populate.