Addon providers (of which heroku postgres is) can change the the config var they set at any time. Simply copy-and-pasting creds from one app to another will leave the second app broken when those creds are changed.
Heroku Postgres is now a standalone product (You can purchase postgres databases without a heroku app) so they won't change the URI for a database out from under you.
If this is being presented as a security problem, know that this is a non-issue. This is intended behavior; Heroku config vars are considered secret. If this is just showing off that you can run multiple apps from a single database, then, yes, that too should have been clear.