So it looks like the filebeat setup command is loading filebeat.yml but ignoring the module configs when setting up the pipeline.
If you configure var.convert_timezone=true in filebeat.yaml,
or add it to the setup command like this filebeat setup --pipelines --modules system -E output.logstash.enabled=false -E output.elasticsearch.hosts=['localhost:9200'] -M system.auth.var.convert_timezone=true -M system.syslog.var.convert_timezone=true
the ingest pipeline is created as expected