In a traditional system running many services - yes.  One compromised service can see the rests command line arguments.  But todays deployment model tends to be light weight containers, each system runs one and only one service.

But I should probably also document the environment variable approach here.