The problem with configuration expressed as a code is that it is not automatically auditable. With simple ini or json files, the auditing tool can just parse them, or, even worse, grep, and find out if a particular option has a certain legally-mandated value. This also applies to configuration files generated via templating - you just feed the end result to the auditing tool. With the code, the auditing tool would need to run the code, and this is a no-no from a security perspective.