> You need some way to pass secrets to the app

Absolutely. This is why the env method is so attractive. It's simple and feels "free".

> doesn't every other way also suffer the same kind of issue

Not entirely. Accessibility (or dev ergonomics) and security are opposite ends of the same dial. As the other commenter wrote: a workload identity and a vault, and sharing the secrets between the two in a way that doesn't leave a plain-text trace for everyone to read (the environment is not private).

I like sops: https://github.com/getsops/sops