I looked into the source of OpenSSH for this.
It seems that having UsePAM might indirectly or directly leak your env according to the
auth-pam.c comment I found here in lines 378-382 (link here):
* XXX this possibly leaks env because it is not documented
* what pam_putenv() does with it. Does it copy it? Does it
* take ownweship? We don't know, so it's safest just to leak.
Also in the same source code I found this interesting content:
* Some silly PAM modules (e.g. pam_time) require a TTY to operate.
* sshd doesn't set the tty until too late in the auth process and
* may not even set one (for tty-less connections)
It also seems that password authentication is attempted via PAM on line 1351 and a anti-timing attacks mitigation is used in this code.
Since it's defined in a if clause all this
auth-pam.c code does not get executed so I would set to no if your security settings allow you to.
So in my opinion I would rather set it to no and don't lose sleep over it anymore.
There's also this opinion: https://askubuntu.com/questions/1259848/
It seems that SSH public key auth might fail if you setup your settings badly:
I would also recommend reading this conclusion at the end of the
Configuring accounts section: