Agreed. It is not a good idea to store the db user/password in a docker-compose.yml file, but it is nice for demonstrating with a container that's more than a "hello world" + non-production use cases.
yeah, also, isn't composed file part of docker layer and thus can be traced back even if you change them?
No. A docker-compose.yml just provides runtime configuration.
In other words, a Dockerfile specifies what you want to build, and a compose file specifies how you will run it.