Agree, not expanding is dumb.

One of the major benefits of a shell-based approach is your env vars could be generated from the output of a command.

Which can be trivially used to populate secrets from whatever your secret store of choice is.

Now we've also cleanly solved secret distribution for developers with one less dependency!