OK, I think I follow all this now.
This is expected behavior. The environment variables end up as command line options for the Kibana process. We are going to update the documentation to make this more clear moving forward.
The easiest way to solve this problem is to bind mount a kibana.yml file into your container that contains the username and password. The docs for doing this can be found here
https://www.elastic.co/guide/en/kibana/current/docker.html#bind-mount-config
You can also use the Kibana keystore but it's more involved than bind mounting a configuration file.
I hope this helps.