Use your host’s database backup (cPanel’s Backup or phpMyAdmin → Export), or mysqldump / pg_dump if you have a shell. Take one before every major update.
Copy database/database.sqlite while the site is quiet. If you have a shell, sqlite3 database/database.sqlite ".backup backup.sqlite" is safe even under traffic.
APP_KEY signs sessions and, unless you set TIDEMARK_SALT, seeds visitor ids. A lost .env doesn’t lose data, but everyone is signed out and today’s visitor ids change.