Yes, I think that env vars are superior to a file or CLI args. One advantage is that you can pass secrets without persisting in a file or making them visible to other processes through CLI args.
Env vars are visible in /proc/PID/environ, though? That said, the mode on environ seems to be 600 on my system, so only processes with the same UID can see them.