Good job getting it figured out!
When you run vagrant up or vagrant provision, the wordpress-install role will create the .env file on the VM in a directory that is synced to your local machine site/.env.
Thus the DB_USER in .env will be created from the db_user in your group_vars/development/wordpress_sites.yml file if defined (it’s optional), else will default to example_com, or whateverdomain_com (any dots replaced with underscores).
The DB_PASSWORD in .env will be created from the db_password in group_vars/development/vault.yml.