You are suggesting in the demos that the settings.py file should contain de development definition of variables and override them later on with loading the specific settings from yaml.
would contain the development oriented definitions, e.g., database
definitions for user and password for a development database. The
settings file would then end with a call the the load function.
Additional definitions could be defined after the load function to
update conditional definitions, e.g., if DEBUG is enabled.
This approach is not very security oriented because there is always the danger to forget to override a specific variable and hence make the app less secure. I would suggest to have the most secure, drastic values set by default in settings.py and then loosen them up in yaml files. But, it's only a suggestion.
Best regards,
Gabriel