"MY_APP_SECRET_KEY=bla myapp" hardly accomplishes anything substantial over "myapp --secret-key=blah" It's just a less robust and less well-supported command-line interface. It's not supported by most gui launchers, PowerShell, nor many cron implementations, for example.
The command line can be read by any user on the host (with `ps auxww` for example) while the environment cannot.
You should never pass secrets on the command line.
Environment variables are not more secure than command line parameters! It's such a common misconception that because environment variables are "not seen" they can serve as a secure channel. They emphatically cannot.
Secrets being hidden ("not seen") is really their main quality...